Plugin Review Guidelines

It runs on every version you submit, before a person looks. Failing the manifest, size, safety or text check refuses the submission at once, with the reason. Anything else goes to a person with the checklist, which you see too.

• A valid manifest. An id (author.name), a version (x.y.z), API 1, only known permissions, and every site it reaches named.
• Size. The package is at most 5 MB.
• No eval. No eval or new Function, and no attempt to reach past the athanor API: no worker imports, raw network, storage or parent windows.
• Readable code. A reviewer has to be able to read what runs, so no code that is one long minified line.
• Declared sites only. Every web address in the code is a site the manifest names.
• Structures screened. Every structure the code ships (templates, examples, data) goes through Athanor's chemical safety screen, against the controlled substances and chemical weapons lists.
• Text filtered. The listing (name, tagline, description, tags) goes through the community text filter.
• The listing is complete. A reason for every permission, both data questions answered (does it send document content anywhere, does it store anything), and a support contact.

A moderator reads the checklist, the permissions with your reasons, your data answers, your notes and the code, and asks:

• Quality. It is complete, does what the listing says, does not crash or hang, and its listing, images and name are accurate.
• Trust and safety. It never reads or changes a document without the user knowing; it uses the least data it can; nothing about it is deceptive.
• Chemistry safety. It does not offer routes, syntheses or procedures for controlled substances or chemical weapons, and its structures pass the screen.
• Business. No advertising inside Athanor, and it is not only a resale of a feature Athanor already gives everyone.
• Legal. If any data leaves the user's computer, the listing links a privacy policy, and your data answers match what the code does.

The outcome is one of: Approve, Request changes (with a note telling you what to fix), or Reject (with the reason). You get an email either way, and the status shows in Development.

Every permission in your manifest needs a one-line reason, written for the person installing, and it shows on the permission sheet before they install. Ask only for what the plugin uses.

• Read the open document: say what it reads and why ("Reads the selected structures to compute their charges").
• Edit the document: say what it changes. A community plugin's first change appears as a preview the user accepts.
• Access the internet: name each site and say what goes there. Access to any site (“*”) is never allowed. With Read the open document, the sheet adds that the document's contents could be sent to those sites, so be precise.
• Save files: say what files it offers to save.
• Know who you are: say why it needs the user's display name and avatar. It never gets their email or password.

• Every version runs the automatic screen.
• A version that only changes code and passes every automatic check goes live at once, and a moderator looks at it afterward.
• A version that adds a permission or a site waits for a person first, and then for each user to agree before it runs on their computer. Until then they keep the version they have.

• Reports. Signed-in users can report a plugin as not working, misleading, harmful or unsafe chemistry, a privacy or data concern, malicious, inappropriate, or infringing copyright, with a note. Reports go to the moderation queue.
• Hidden at three. Three open reports from different people hide a plugin from Discover until a moderator looks. People who installed it keep it while that happens.
• Delist. A plugin can be removed from search while existing users keep it, for problems that do not put anyone at risk.
• Takedown. For malicious behavior, a privacy breach or unsafe chemistry, the plugin is removed and turned off on every computer: the app checks the takedown list when it starts and every 6 hours, tells each person why, and keeps their settings and data.
• Ratings and reviews. One rating (1 to 5 stars) per person, and authors cannot rate their own. You can reply to reviews and turn comments off. Limits: 20 submissions a day per account, 20 comments an hour and 20 reports a day.
• Appeals. Reply to the decision email, or write to [email protected], saying what you changed or why the decision is wrong. A different moderator looks at it where we can.

• A "retrosynthesis helper" that suggests routes to a scheduled drug or a nerve agent precursor.
• An exporter that sends the whole document to an analytics site it never named, or a manifest that asks for any site (“*”).
• A plugin whose listing says it reads only the selection, while its code reads every structure in the document.
• Code shipped as one long minified line, so nobody can tell what it does.
• A "sign in to sync" panel that asks for the user's arbastro password.
• A plugin that shows ads in a panel, or wraps a feature Athanor already gives everyone and charges for it elsewhere.
• A listing that copies another plugin's name and icon, or uses images the author has no right to.
• A plugin that crashes on a blank document, or whose commands do nothing.
• Data answers that say nothing leaves the user’s computer, for a plugin that calls an outside API.

Questions before you submit, or about a review: [email protected]. The developer guide in the app (Plugins › Development) starts from a template that already passes the automatic screen.