Green Light checks
A Green Light result tells buyers which automated checks a listing passed, when, and with which tools. The same rules apply to every seller, including GreenGo's own products.
Every listing on GreenGo can earn a Green Light badge. It means the product passed our automated checks on the date shown — nothing more, nothing less.
- Ownership. The seller proves control of the domain with a DNS record.
- Header check. The MDN HTTP Observatory from Mozilla grades the HTTPS setup and security headers of the public home page.
- File check. We scan the product files the seller uploads for leaked keys, .env files, .git folders, source maps and private keys.
Badges expire after 90 days, and passing listings are re-checked every week. Automated checks are not a security audit or certification.
What is checked
| Check | Tool | Maintained by | To pass |
|---|---|---|---|
| Site ownership | DNS TXT record | GreenGo | The seller proves control of the domain with a one-time code in DNS, and has authorized the checks. |
| Security headers | MDN HTTP Observatory | Mozilla | Grade B or better for the live site (HTTPS, content security, framing, cookies and related headers). |
| Exposed secrets | Gitleaks | Open source (MIT) | No API keys, tokens or private keys found anywhere in the delivered files. |
| Vulnerable dependencies | OSV-Scanner + OSV.dev | Google (Apache-2.0) | No known vulnerability with a CVSS score of 7.0 or higher in the declared dependencies. Lower severities are shown to the seller. |
| Delivery file hygiene | GreenGo file checks | GreenGo | No .env files, .git folders, source maps or key files shipped to buyers. |
Live sites get the ownership and header checks. Listings that deliver files or code also get the secret, dependency and file checks, run on exactly the files a buyer receives. Every check must pass for a Green Light.
How long a result counts
- Checks run on their own. No one at GreenGo starts, edits or approves them: they begin right after the seller confirms the domain, within an hour after delivery files change or a result expires, and once a day while an issue is open.
- A passed result is shown as current for 90 days from the check date, which is printed on every report.
- Passed listings are re-checked automatically every week; code is scanned again first, so newly published vulnerabilities count.
- Uploading, removing or changing a delivery file clears the result until the new files are checked.
- If a re-check finds an issue, the public status changes right away.
Payment never buys a pass
Plans, Spotlight placement, Monitor and human review do not change any criterion. A seller cannot edit their report, and admins cannot mark a check as passed: results come only from the tools above.
The badge
Sellers can show a Green Light badge on their own site. It is served live by greengopartners.com and links to the public report, so it disappears when a result expires or a re-check finds an issue. A copied image of a badge that does not link to a report here is not a Green Light result.
What is public and what stays private
- Public: the status, the check date, and pass or "issues found" for each check.
- Private to the seller: file names, line numbers, package names and advisory IDs, so issues can be fixed without exposing them.
- Code is scanned in a temporary GitHub-hosted runner and deleted when the scan ends. Logs record counts only. Secrets are redacted before any result leaves the runner.
What a Green Light does not mean
Headers by MDN HTTP Observatory (Mozilla). Code: secrets by Gitleaks, dependency vulnerabilities by OSV-Scanner (Google OSV database), file checks by GreenGo. Automated checks only — not a security audit or certification.
Automated tools find known patterns. They cannot prove an app has no vulnerabilities, check business logic, or judge how a product handles your data. For a deeper look, a seller can order a human review, and buyers keep 14-day Buyer Protection on paid purchases.
Questions and disputes
A seller fixes the issue and the check runs again automatically: within the hour after new files are uploaded, or the next day for site changes. Questions about a finding go to info@greengopartners.com with the report date. Buyers can report a listing from its page.
Methodology version 2.0 · updated Oct 20, 2026
Try the free header check →