Build a vApp, get it validated automatically, and publish it to customers — most simple
apps go live the moment they pass. Here is the whole journey, end to end.
A published vApp is just a .vapp package — a small zip of
index.html + assets + a manifest.json.
You build it, we check it, and it runs sandboxed in every customer's Vizum desktop.
① Build
🔨
Two ways to build — same installable .vapp
Write a simple app by hand (HTML + JS + a manifest — no build step), or use the
sdk-next toolchain (TypeScript, a typed ORM, UI kit, charts, forms, 3D) with the
vzm CLI. Either way the output is the same package.
# scaffold, then package into a validated .vapp
vzm new my-app --template vanilla-ts
vzm pack my-app # → my-app.vapp
TIP The full SDK (9 @vizum/vapp-* packages),
examples, and the typed ORM live in the SDK documentation.
② Validate — automatic, before a human ever looks
The moment you submit, every package runs through an automated pipeline. You get a
structured report; nothing privileged reaches customers without passing it.
Permission & risk classificationWhat the app can touch decides its review path (see below).
3
Code vetAny server-side script or computed field is parsed against a strict safe-subset — imports, dunder access, eval/getattr and friends are rejected.
4
Static scanAssets are scanned for hardcoded secrets and risky patterns.
5
Sandbox smokeThe package is loaded in the real opaque-origin sandbox to confirm it boots cleanly.
③ Submit
📤
Upload your package & details
Sign in, accept the developer revenue-share terms, and upload your
.vapp with a summary, category, screenshots, and a changelog at
/my/vizum-apps/submit. You can
preview it running in a sandbox before it goes anywhere.
④ Review — risk-tiered, so simple apps are fast
Your app's permissions decide the path. Most apps ask for nothing privileged and
publish automatically; anything powerful gets a human's eyes first.
TIER ZERO Auto-publish
Apps that only use their own private storage / UI — nothing that touches customer data or the platform's powerful capabilities.
✓ Passes the pipeline → published instantly
PRIVILEGED Human review
reads/writes Odoo records (orm)
outbound network, AI, OAuth, devices
native models/fields (schema), server scripts, business actions
Passes the pipeline → queued for a reviewer
A failing package is rejected automatically with the exact reasons — fix them and
resubmit. A reviewer approves or rejects privileged apps with feedback you can act on.
⑤ Publish & ⑥ Earn
🌍
Live in the catalog, paid on every sale
Once published, your app appears in the in-desktop Vizum App Store for every customer.
Paid apps run on a revenue share — your earnings are tracked per sale and shown in your
developer dashboard.
Before you submit — a quick checklist
✓
Reverse-DNS id + semver versione.g. com.acme.invoices and 1.0.0. The id is permanent.
✓
Only the permissions you actually useFewer permissions = tier-zero = instant publish. Don't over-ask.
✓
No hardcoded secrets or keysUse the platform's secret vault; the static scan will flag anything that looks like a live key.
✓
It boots clean in the sandboxTest it in a desktop first — the smoke check confirms the connect handshake with zero console errors.
✓
An icon, a clear summary & a screenshotThis is what customers see in the catalog.
Security you can rely on: every vApp runs in an opaque-origin sandbox and can never touch a
customer's Odoo session directly — all data access goes through the permission-checked bridge,
as the user, never beyond the grants they approved.