On this page
Theaimart lists software made by independent developers, so "is it safe?" is a fair question to ask before installing anything from it. This article describes, step by step, what happens to a native app build between the moment a developer uploads it and the moment it runs on your computer — and where those checks stop.
It covers native builds (Android, Windows, macOS and Linux files). Web apps listed on Theaimart are not downloaded at all: their listing links to the developer's own site, and that site's security is the developer's responsibility.
1. The upload is inspected before it is stored
When a developer uploads a build, the server runs three checks before the file is kept:
- File validation. The file must match the platform it is uploaded for, by extension and by its actual contents, and stay under the size limit. A renamed file of a different type is rejected.
- Credential scan. The package is unpacked and inspected for credentials shipped inside it, such as live API keys. By default an upload that contains them is rejected, because anyone who downloads the app could extract and misuse those keys.
- Malware scan. The file's SHA-256 hash is checked against VirusTotal. A build that VirusTotal flags as malicious is rejected outright. A file VirusTotal has never seen comes back as pending and is re-scanned automatically in the background.
The result — platform, file name, size, SHA-256 and scan verdict — is recorded in a signed receipt that the developer's listing must carry. A developer cannot type in their own scan result.
2. Pending builds are never distributed
A build whose scan has not come back clean is not handed out, whatever the listing says. This covers both pending builds and builds that could not be scanned because the scanner was unavailable.
3. A listing is reviewed before it is public
New listings are created as pending and appear on the marketplace only after an administrator approves them.
- A listing with a build that the scanner flagged cannot be approved.
- A listing with a build whose scan has not passed can only be approved with a written reason from the administrator, which is logged. It is an explicit override, not a default.
Approval is not a one-time event. Under the Terms of Service, Theaimart can remove, restrict or delist a listing later.
4. Downloads go through an entitlement check
Builds are stored privately; there is no public address to fetch them from. When you install an app, the desktop AI App Store asks Theaimart for a download link. The server checks that you are allowed to have that build — for a paid listing, that you bought it — and returns a link that expires after a short time.
5. The desktop app verifies the build before installing it
Every published build carries an ed25519 signature from Theaimart covering its description: the file, its checksum and the platform it is for. Before downloading, the desktop AI App Store checks that signature in its native code, not in its user interface, and refuses any build whose signature is missing or does not match. After downloading, it compares the file's SHA-256 checksum with the signed value and refuses a mismatch.
This is what stops a tampered or swapped file from being installed through the store, even if someone interferes with the download.
What these checks cannot tell you
Being honest about the limits matters as much as the checks themselves:
- A clean scan is not proof that software is safe. VirusTotal detects known malware. New or targeted malicious code can pass it.
- Checks look at the file, not the developer's intentions. An app can collect more data than you expect without containing malware. Read the listing's privacy policy link when the developer provides one; the listing says so when they have not.
- Theaimart is not a party to your agreement with the developer. The Terms of Service set out what Theaimart does and does not guarantee about third-party listings.
- Web apps are outside this pipeline. They run on the developer's servers.
What you can do
- Install native apps through the desktop AI App Store rather than from files shared elsewhere, so the signature and checksum checks run.
- Compare the SHA-256 shown on a listing with the file you have, if you obtained a build some other way.
- Check who the developer is and whether a privacy policy is linked before installing.
- Report a listing that behaves suspiciously to contact@theaimart.co, the address the Terms of Service name for abuse reports, or use the contact form.
Developers publishing on Theaimart can find the submission steps in the developer documentation, and people browsing can start from the AI App Marketplace.
