Skip to content
DappStoreSign in
Trust & safety

How trust works on DappStore

Labels and reviews reduce uncertainty. They never guarantee that an app is safe or profitable — crypto apps can change overnight. Here is exactly what each label means and how it is earned.

Every listing

Approved before it appears

New listings are reviewed against our guidelines before they become public. Approval means “meets the rules”, not “safe”.

Automated security checks

Launch URLs are checked against threat-intelligence sources, for newly registered domains, private-network targets, look-alike names of known apps and broken links.

Honest disclosures

Developers must declare wallet permissions, data collection and custody. Misleading disclosures are grounds for suspension.

Trust labels

DappStore Reviewed

A DappStore moderator completed the full review checklist for the current version: launch URL, declared permissions and data practices were checked against the live product.

  1. A moderator opens the live product and checks the launch domain matches the listing.
  2. Declared wallet permissions and data practices are compared with what the product actually requests.
  3. Automated checks (threat-intelligence lookups, domain age, impersonation, broken links) must be clean or explained.
  4. Granted per version: a change of launch domain, permissions or app type sends the listing back to review.

Developer Verified

The developer proved control of their website domain (DNS TXT record or a file under /.well-known) and a moderator confirmed the profile.

  1. The developer publishes a DappStore token in a DNS TXT record or at /.well-known/dappstore-verify.txt on their website.
  2. DappStore fetches it (from the public internet only) and a moderator confirms the profile.
  3. Changing the website domain removes the label until it is verified again.

Open Source

The linked repository is public on GitHub and carries an OSI-approved licence, checked automatically against the GitHub API.

  1. The listing links a public GitHub repository.
  2. The GitHub API must report an OSI-approved licence (e.g. MIT, Apache-2.0, GPL).
  3. Checked automatically; re-checked when the repository link changes.

Independently Audited

At least one security audit report was confirmed by a moderator to come from the named auditor and to cover this product. Audits are point-in-time.

  1. The developer lists the auditor, date, scope and a link to the report.
  2. A moderator confirms the report is hosted by the named auditor and covers this product.
  3. Audits are point-in-time: later code may not be covered. Unconfirmed audits are shown as “Claimed by developer”.

Labels cannot be bought. Paid plans and sponsored placements never affect labels, approval or organic ranking.

Staying safe

  • Never type a seed phrase or private key into any website, bot or form. No legitimate app needs it.
  • Check the domain in the “Leaving DappStore” dialog before connecting a wallet.
  • Read the permissions section: custodial bots and unlimited token approvals carry real risk.
  • Revoke approvals you no longer need, and use a separate wallet for new or unreviewed tools.
  • Signing in to DappStore with a wallet only ever asks you to sign a text message — never a transaction.
  • Be wary of “guaranteed returns”. We remove listings that promise profits.

Reporting

Use Report on any app, review, developer or public collection (you need to be signed in). Reports go to moderators, who can suspend apps, remove reviews and revoke labels. Every moderation decision is recorded in an audit log.

Scam or fraud Malicious link or wallet drainer Fake application Impersonates another project Misleading claims (e.g. guaranteed returns) Suspicious wallet permissions Broken or offline Spam Something else

Found a vulnerability in DappStore itself? Contact the team through the developer portal.