# How UpFork checks code

> What UpFork checks before a developer's code goes on sale and after: its install, its code and its packages, an admin's approval of each revision, the daily package watch, rolling back, and reporting a product.

Developers sell code on UpFork, and code you install runs with your project's rights: in your visitors' browsers, and
on your server for route handlers and server actions. So before a developer's code goes on sale, and every time it
changes, UpFork reads it and its packages, and an admin approves that exact revision. Here's what that covers, and what
it doesn't.

## Before it goes on sale

Every save of a developer's code is checked three ways:

- **Its install:** the shadcn CLI installs it into a fresh Next.js project (a mobile component into a fresh Expo app),
  which then type-checks, as yours will. Code that wouldn't install never reaches anyone.
- **Its code:** UpFork's scan reads every installed file and demo for what a reviewer has to see: the sites it sends to
  or loads from, text it runs as code, code that hides what it does, private things it reads (cookies, storage, the
  clipboard, environment variables), and code that runs on your server. It flags; it doesn't decide.
- **Its packages:** the npm packages it brings, and everything they bring, are read for install scripts, names a letter
  or two from a well-known package, new or little-used packages, deprecation, and known malware. Known malware stops it.

Then an admin looks at that revision on one page: what changed since the one on sale, the flags at their lines, the new
packages, and its preview. Only once they approve it do installs, downloads, the AI prompt and its page move to it;
until then you keep getting the revision that was approved before. UpFork's own products go out after the same checks.

## What a product's page tells you

- **Connects to:** the sites the product's code talks to, each with what it sends there or loads from it, as its
  developer names them. The scan sets those apart from any it doesn't name, and the admin sees both.
- **npm packages:** what the shadcn CLI adds to your project with it.
- **Revision:** the revision you install. A newer one reaches you only once it's approved.

## After it's on sale

- **Packages are watched daily.** Your npm installs the newest version of each package, so UpFork asks npm about the
  newest version of every package a product on sale names. A new version that runs an install script, a deprecation or
  known malware tells the admins, with the products that use it.
- **A revision can be put back.** UpFork keeps the last revisions that went out: if one turns out wrong, the one before
  goes back on sale at once.

## Report a product

If a product does something its page doesn't say, sends what it shouldn't, or its packages look wrong, open its page and
choose **Report a problem with this product**. It opens a support ticket about it that UpFork reads first.

## What it doesn't promise

The checks help the review, and the review is the gate, but no review catches everything. UpFork reviews developers' code
and checks its packages; no product is guaranteed free of harm or bugs. Read what you install, as you would any code,
and test it before you depend on it.

Page: https://upfork.dev/docs/safety