Build a plugin for LifeHQ
1. Apply for a developer account
Tell us who you are, where to reach you, and what you intend to build. Applications are approved by a person rather than a filter, usually within a few days. A rejection always comes with a reason you can act on.
2. Write the manifest
The manifest declares an id, a name, a version, the permissions you need, and any external host you will contact.
Ask for the narrowest set that works. Every permission is shown to the user at install time, and a long list is a reason not to press the button.
3. Write the bundle
Your code runs in a sandboxed frame. There is no cookie and no direct API access; instead you get a bridge whose methods mirror the permissions you asked for.
Calling a method you did not declare is refused at the server, not merely hidden in the client — so there is nothing to be gained by probing for it.
4. Submit it
Upload the bundle. It goes to a quarantined area and is not executed there: not by a build step, not by a scanner, not at all. It is hashed and checked, and the file is not reachable by any user until it passes.
5. Review, then publish
If it passes, the bundle moves into place pinned to its hash, so the code users run is exactly the code that was reviewed. If it does not, you get the findings and can resubmit.
What we look for
- Permissions that match what the plugin plainly does
- No attempt to reach outside the sandbox or fetch code at runtime
- Declared network hosts that are the ones it actually contacts
- An honest description — the install dialog is a promise
- A privacy policy of your own, if you send data to your own servers