Release Checklist

Use this checklist before you upload an app or theme.

Package

• the ZIP contains built files, not only source files
• manifest.json is present and valid
• icon.svg, thumbnail.jpg, and header.jpg are present
• header.jpg is exactly 1000x263
• the entry file exists

App-Specific

• settings.json exists if the app needs App Global Settings
• settings-global.json exists if the app needs secure App Global Settings
• groups and placeholders exist if the app needs App Instance Settings
• inputs.json exists if the app collects submissions
• every field key used in code matches the schema files
• custom admin tabs are declared in admin_pages only when needed

Theme-Specific

• theme.config.json exists and matches the shipped entry
• theme values fall back safely when user overrides are missing
• app-card styles do not break installed apps

Privacy and Security

• all external domains are declared in the manifest privacy section
• third_party_transfers includes every external API or SDK origin the app contacts
• third_party_embeds includes every framed or embedded third-party origin
• visitor_consent_text is present when consent is required
• gdpr_lawful_basis, data_controller, and data_processor are set for apps that process visitor data
• no secret is stored in a public settings file
• no raw internal Shuuka API routes are hardcoded in the app
• loading, error, empty, and success states are implemented

Submission

• Developer access is turned on in Settings > App preferences
• open the new app upload page for the final ZIP upload
• test the uploaded bundle as an installed app or theme
• verify the package on desktop and mobile
• verify translated labels if the package ships with multiple languages