Trust
Every app is certified, signed and scored.
Spark runs a fast, automated pipeline on each submission. No app reaches the catalog — or a host — without passing it.
The certification pipeline
Manifest validation
Every submission must ship a valid W3C MiniApp / Web App Manifest — name, start_url, display and icons are required.
Static analysis
The signed package is inspected for structure, size and obvious risk patterns before anything runs.
Permission consistency
Requested capabilities (camera, location, storage…) must be declared in the manifest. Undeclared permissions fail the review.
Sandbox test
The app is booted in an isolated runtime to confirm it loads and behaves within its declared surface.
Network allow-list
Outbound calls are checked against the app's declared endpoints.
Host policy review
Automated policy checks for the categories and hosts the app targets.
Signing
On pass, the version is signed and given a trust score. The signature travels with the app to every host.
Trust score
Each certified app carries a trust score out of 100. It starts at 100 and drops for every failed or degraded check. Visitors see the score on the listing; publishers see the full check breakdown in their console. A failed submission returns a specific, fixable issue list.
Security & signing
Signed manifests
Every approved version is signed. Hosts verify the signature before running the app.
Permission transparency
Declared capabilities are shown on the listing so users know what an app can access.
Report an app
Spot misuse or impersonation? Email trust@sparkmobile.app and we review within one business day.