devys is a real marketplace — buyers pay real money, so nothing broken or unsafe reaches them. Every upload passes two automatic checks in seconds. Here's exactly how to package your app so it clears both on the first try.
When you upload, devys runs both of these before your app can go live. Pass → it's listed instantly. Fail → you get the exact reason, so you fix it and re-submit.
A deep scan of every file — it unpacks archives layer by layer and blocks anything dangerous.
Confirms your upload is a complete, runnable app — not a broken folder with missing pieces.
devys sells more than browser toys. Pick your platform when you list, and the right path applies automatically.
Runs right in the buyer's Library, in a locked sandbox — no install. A single .html or a .zip with an index.html.
Source code, scripts, CLI tools, or a whole project .zip the buyer downloads and runs themselves. Set your platform to anything other than Web.
Drop your .zip (or a single .html) and we'll run the real security + completeness checks right here — no account needed. The final run-test happens when you upload to a listing.
If an upload gets bounced, you'll always see the exact reason. Here's what each one means and the one thing to change — in plain English. Almost every rejection is a missing file or an external link.
<style> tag and the JS into a <script> tag right in index.html). Inlining everything into one .html is the surest fix — then there's nothing left to miss.index.html at the root of your zip (not inside a subfolder), or just upload the single .html file on its own..exe, .dll, .sh, .bat, or similar in your upload. devys only distributes things that run safely in the browser. Remove it and ship web files only (.html, .js, .css, images).A fair thing to wonder — you're running strangers' code. Here's precisely what protects you, as a buyer and as a builder.
Every app runs inside a locked browser sandbox with its own isolated identity. It can't read your files, your other tabs, your accounts, or your devys login — and it has no way to phone anything home.
Paid apps are never exposed for free — only buyers get the file, through a private, expiring link. Free apps can be previewed live; paid ones only ever show the cover you choose.
Six things. Tick them all and your app sails through.
index.html at its rootIt should run by double-clicking index.html — no build step, no install.index.html.<script src="https://…">..exe/.dmg/.sh, no installers, nothing that touches the user's files or system.README.txtOne line on what it does, one line on how to run it.Vibe-coded it with an AI? Paste this prompt with your app and it'll hand you a folder that passes both checks. Copy it, drop your code in at the bottom, done.
# Paste this into your AI (Claude, ChatGPT, Cursor…) along with your app. You are packaging a web app to sell on the devys marketplace. It must pass TWO automated checks or it can't be listed: • SAFE — a deep security scan: no executables, installers, obfuscated code, trackers, or crypto/wallet code, and nothing that touches the user's files or system. • WORKS — a functional check that opens the app and confirms it actually runs, with every file it needs included. Package my app so it passes 100%. Follow these rules exactly: 1. Ship ONE self-contained folder with an `index.html` at its root that runs by double-clicking it — no build step, no install, no server. 2. Include EVERY file the app references (JS, CSS, images, fonts). Nothing missing, no broken links. When in doubt, INLINE the CSS and JS into index.html. 3. Work fully OFFLINE. No calls to a backend, API, or external CDN. If you use a library, bundle a local copy — never <script src="https://…">. 4. 100% client-side. No executables (.exe/.dmg/.sh), no installers, and no code that reads or writes the user's files. 5. Family-friendly and digital-only. No adult content. 6. Add a short `README.txt`: what it does + "open index.html in a browser". Then output the final file tree and the full contents of every file, ready for me to zip and upload. Here is my app: [paste your code, or describe what you want it to do]
Attach your app folder to a listing in the app and hit publish.
Security + functional, in seconds. We open it, resolve every asset, and confirm it runs.
Pass and it's listed. Fail and you get the exact reason, e.g. index.html references app.js but that file isn't in the package.