A marketplace badge proves just what its program defines. A verified publisher mark proves control of a domain. A self-assessment badge shows the vendor's own statements. An independent audit badge shows a point-in-time review. None proves that an update tomorrow is safe, so read each badge for its exact claim.
Four badges, four claims
| Badge | Program | What the documentation says it shows | What it does not show |
|---|---|---|---|
| Verified publisher (VS Code Marketplace) | Visual Studio Marketplace | The publisher proved domain ownership, and the Marketplace verified the domain and the publisher's good standing for at least six months | That the code is safe or that the next update is |
| Publisher attested (Microsoft 365) | Microsoft 365 App Compliance Program | A vendor self-assessment of security, data handling and compliance practices, published for customers | Independent verification |
| Microsoft 365 Certified | Same program | A yearly independent audit including penetration testing, across application security, operational security and data handling | Behavior outside the audit scope or after it |
| Safety scorecard (Obsidian) | Obsidian community directory | Results of automatic scans of each plugin version for vulnerabilities, code quality issues and malware | Intent, or permissions, since Obsidian says it cannot restrict plugins to specific permissions |
Google's restricted scope verification adds a fifth type: for apps that reach restricted data through their own server, an annual assessment by a Google-approved third party, with documented exceptions such as internal use.
Three questions for any badge
- Who checked? The vendor, the marketplace, or an independent party?
- What was checked? Identity, code, data handling, operations?
- When, and how often? A one-time check, per version scan, or yearly audit?
A badge without clear answers is decoration.
Why badges still help
They let you spend review effort where it counts. An attested app with access to little data may need a quick look. A tool with broad scopes and only a self-assessment justifies requests for evidence. That is a sensible use: the badge sets your starting depth, not your final answer.
The Microsoft documentation also says certified and attested apps get dedicated pages with information to help speed up security and compliance reviews. Use those pages as input to your questions.
Common misreadings
- "Verified means vetted." Verified publisher means identity and standing, not a code review.
- "Certified means compliant with everything." The controls are based on common standards. That is not the same as holding every report.
- "Scanned means safe." Scanning finds known patterns, not all risk.
- "Featured means secure." Popularity and editorial choice are different from security review.
How to record it
In your approval record, note the badge, the program, the date you checked it and the evidence you read. Our post who should approve a new plugin describes tiers that tell you how much more to ask for.
For the structure behind the three protection models, read sandbox, permissions or review.
Safeguard does not issue marketplace badges. It helps you build evidence of your own security practices, including SBOMs, scan results and compliance evidence automation, so your answers to buyers rest on records.
Quick check
Is a self-assessment badge worthless?
No. It gives you the vendor's published statements that you can test and challenge. It carries less weight than an independent audit.
Does a verified publisher mark cover future updates?
No. It reflects identity and standing at the time of verification, so keep your update controls in place.
Sources
- Extension runtime security, Visual Studio Code documentation
- Microsoft 365 App Compliance Program overview
- Plugin security, Obsidian Help (source text)
- Restricted scope verification, Google for Developers
Last reviewed: 19 October 2026.
