How GHAN vets and scores apps
No app can trade on GHAN until it passes an automated gate covering code signing, malware scanning, domain age, contact verification and binary identity. After that a reputation score ranks it, and once it has traded 500 installs its measured behaviour replaces reputation entirely.
Layer 1 — the gate
Pass or fail, fully automated, run on registration and again every week.
| Check | What is verified | Source |
|---|---|---|
| Code signature | macOS notarisation ticket, or a valid Windows Authenticode chain | Apple notarisation API / signature inspection |
| Malware | No malicious or suspicious engine detections above threshold | VirusTotal |
| Domain age | At least six months since registration | RDAP |
| Contact | A challenge message to the declared address is answered | Email challenge |
| Binary identity | The download URL serves the bundle id the app declared | Direct fetch |
Failures return as reason codes through get_score, not as prose in an email. A founder's agent can read the failure, fix what is fixable, and re-trigger.
Layer 2 — reputation, 0 to 100
Reputation is what GHAN knows about an app before it has traded anything.
| Component | Weight | What it measures |
|---|---|---|
| AI visibility and sentiment | 50% | Share of voice against the app's real category rivals in AI answers, and how those answers characterise it |
| Release cadence | 20% | Time since the most recent release, from a GitHub release feed or a Sparkle appcast |
| Reviews and video coverage | 20% | A floor check on independent reviews and video coverage existing at all |
| Domain and social coherence | 10% | Whether the domain, the app name and the public profiles describe the same product |
AI visibility carries half the weight because for a desktop app in 2026, being absent from every AI answer in your own category is a real signal: it means neither users nor the models answering their questions know you exist. Measuring it as share of voice against actual rivals, rather than as a raw mention count, makes the number comparable across categories of very different sizes.
Release cadence matters because an app that has not shipped in a year is a support burden for whoever promotes it, independent of how good it is.
Scores are cached for seven days.
Layer 3 — behaviour
After 500 installs traded, measured behaviour replaces reputation entirely. Nothing an app says about itself outranks what it has actually done.
- 48-hour retention of installs it referred
- Uninstall rate of those installs
- Canary compliance — does the shipped build answer signed liveness probes
- Complaint rate
Below threshold, an app is auto-throttled. Canary failure suspends it and freezes escrow.
Reading your own score
get_score { app_id: "app_..." }Returns the status, the gate as a set of booleans, the reputation breakdown by component, the behaviour block once it exists, and the next review date. Every rejection reason is a code, not a sentence, so an agent can act on it without parsing English.
Why the gate is public
Publishing the gate makes it gameable in exactly one way: by satisfying it. Signing your binary, keeping it clean, owning your domain for six months, answering your email, and shipping the build you said you would ship are not loopholes. They are the product.
Questions people ask about this
What are the gate requirements?
Five checks, all automated. A notarised macOS build or a valid Windows Authenticode chain. A VirusTotal result with no malicious or suspicious detections above threshold. A domain at least six months old, verified over RDAP. A contact email that answers a challenge message. And a download URL that actually serves the bundle identifier the app declared. Any failure rejects the application with a machine-readable reason.
Why does domain age matter?
Because it is the cheapest check that a disposable operation cannot pass. Registering a domain costs almost nothing, but waiting six months costs an attacker the one thing they are trying to save. It is a weak signal about quality and a strong signal about intent, which is exactly what a gate needs.
How is the reputation score calculated?
Reputation is a 0-100 weighted score - AI visibility and sentiment at 50 percent, release cadence at 20 percent, reviews and video coverage at 20 percent, and domain and social coherence at 10 percent. AI visibility is measured as share of voice against the app's actual category rivals rather than as an isolated number, so the score answers the question a partner actually has, which is whether this app is one that the models answering their users' questions already know about.
What happens if my app fails the gate?
You get a machine-readable list of exactly which checks failed and, where applicable, when they would pass. A domain that is four months old returns the date it becomes eligible. The gate re-runs automatically and nothing needs to be resubmitted by hand.
Is the gate re-run after I am accepted?
Yes, weekly. An app that lets its code-signing certificate lapse, or whose binary starts triggering malware detections, loses its gate pass and stops trading until it passes again. The gate is a continuous condition of membership, not an entry ritual.
Machine-readable versions of this page: markdown · llms.txt · llms-full.txt · OpenAPI · AI catalog