Upload your zip on the Dev Portal (or link a GitHub repo and pull versions from it). Run yourbot validate first — it applies the same checks locally. The reviewer checks:
- Manifest validates: required fields present, capabilities legal, slash commands well-formed.
- Code does not import any disallowed module (
subprocess,ctypes,socket,multiprocessing) or calleval/exec. The sandbox blocks them anyway, but pre-flight catches it before users see errors. - No unparameterised SQL, no f-string interpolation in
ctx.sql.execute. - No surprises — every submission from a new developer gets human review, and a Dangerous-tier request (like
discord:ban_members) is exactly what reviewers weigh hardest. Established developers publishing from a public repo skip the queue as long as nothing security-relevant changed (a flagged scan or a changed dashboard sends that version to review like anyone else's). - Slash command names are legal: no names reserved by built-in services (see the definitive list), no duplicates within your manifest.
yourbot validatechecks this locally.
Reviews target a 24-hour turnaround; allow a little longer over weekends. If denied you'll see specific actionable feedback in the dev portal.
After you publish: updates and rollback
- Auto-updates: installs default to
auto_updateon, so servers pick up your new published version automatically. Include a changelog with every version; it shows on the marketplace page and in update notifications. - Pinning is rollback: server owners can pin any published version; pinning disables auto-update for that server. There is no separate revert button.
- Capability changes: adding any new capability or proxy domain, even a Safe-tier one, pauses auto-update on each install until the admin re-consents — a harmless-looking new capability fragments your install base across versions. Removing one is silent.
- Slash commands propagate per install: Discord sees the commands of each server's installed version, not your latest published one. A renamed option only reaches a server after it updates.