What verified means on the Marketplace and on Open VSX

Both galleries draw a check mark next to some publishers. They are not the same check, they are not earned the same way, and neither one is a statement that the person who uploaded the .vsix wrote the source in the linked repository.

VSXRank stores whatever flag the registry already exposes. We do not issue a badge of our own in v1, and we do not ask you to prove a listing is yours in order to track it.

Marketplace: domain plus six months

Microsoft’s verified publisher badge (the blue check on the listing) means, in their words:

• The publisher proved ownership of an eligible domain (a TXT record on a root domain they control; not a GitHub Pages subdomain; HTTPS).
• The domain has existed for at least six months, and the publisher has had at least one extension on the Marketplace for six months.
• The Marketplace team reviewed the request (their docs say within five business days) for track record, content, and reputation.

Changing the publisher display name revokes the badge. So do Terms of Use violations. Microsoft also says the check is “an extra signal of trust,” not a review of the extension’s code. The runtime sandbox and signature verification are separate systems.

How it shows up in the API, and therefore in our catalog: publisher.flags includes verified, which we store as publisher_verified. A second field, publisher_domain_verified, records whether the domain check itself passed. They usually move together; they are not the same column.

Eligible-domain rules and the TXT flow live in Microsoft’s publishing docs. We do not run that process for you.

Open VSX: namespace ownership

Open VSX verified means you are the owner of the namespace, not that Eclipse reviewed your domain.

The publisher string in package.json is a namespace. The first account that creates it is a contributor. Listings published in that state show a warning: that user account is not a verified publisher of the namespace. Ownership is a separate request.

Eclipse’s current rules (their Managing Namespaces wiki, updated August 2026):

• Your GitHub id must have at least one year of history. A newer id can be added after an older one holds the namespace.
• If the namespace matches your GitHub login, publishing from the website creates it as you go. Otherwise create it with ovsx / the API, then publish, then request ownership.
• If the namespace already exists, you cannot become owner. Someone else already started.

Creating a namespace with npx ovsx create-namespace does not flip the verified flag. That surprise is in the official publishing guide in so many words. See how to publish to Open VSX for the rest of the pipeline.

Open VSX’s verified boolean on the search payload is what we store. It is namespace ownership, not domain ownership, not a six-month clock.

What neither badge proves

• Authorship. A Marketplace listing can point Microsoft.VisualStudio.Services.Links.Source at any GitHub URL. Open VSX repository is the same kind of field. Verified does not mean that repo is the bits inside the .vsix.
• Safety. Malicious extensions have shipped on both registries with and without checks. Treat the badge as identity-adjacent, not as a scan report.
• That VSXRank agrees. We do not have a publisher login, we do not talk to the Marketplace publisher portal (it has no API), and we do not treat a watchlist role of Mine as evidence.

What VSXRank does instead

Anyone can add any extension to a watchlist and mark it Mine or Watching. The role is self-declared and only changes defaults (alerts on or off). There is no ownership step, in the product or in this sentence, because we cannot verify who publishes an extension. Track any extension is the model.

A later phase may let a paying publisher attach structured copy to their public page after proving control of the linked repository (a file we fetch, not a form they fill). That still would not be “this person wrote the extension.” It would be “this person can write to the repo the listing already names.” It is not shipped, and it is not a registry badge.

If you are choosing which check to chase first: Marketplace verified is a trust signal for VS Code users and takes six months of runway; Open VSX verified is what removes the warning on Cursor and friends and can be done as soon as the GitHub account is old enough. Do both. They do not substitute.