Developers

Publishing and review

A person at Pulsar checks every extension, and every update, before it goes live. It usually takes 1–2 days. This page is the checklist they use.

What to prepare

Your .zip (or .xpi), up to about 3 MB, manifest.json at the top. Unsigned is fine.
A name (up to 40 characters), a one-line tagline (up to 100) and a description that says what it does and why it needs each permission.
An icon, your tint colour and up to 6 phone screenshots (portrait; the first is the cover).
A privacy policy link if anything leaves the phone.
Your developer profile at pulsarbrowser.com/account/developer.

Upload
Pulsar reads the manifest at once and lists what the extension will be able to do. Blocking problems (a reserved id, nativeMessaging) stop the upload with the reason.
Review
A person checks the code and the listing against the rules below, usually in 1–2 days.
Signing
Mozilla signs the file (unlisted) and Pulsar adds its seal.
Live
You get an email. Phones with the extension get the update within a day.

Rule	What it means
No downloading from sites that forbid it	No downloaders for video sites, and nothing that saves video or music from a site whose terms forbid downloading. Your own files and openly licensed media are fine.
No hidden or remote code	Everything the extension runs is in the file you upload. No obfuscation, no `eval`, no scripts fetched from a server and run later. Minified is fine; send the source if we ask.
Permissions match the purpose	Ask only for what your listed features need. “All sites” needs a reason a user would understand from the description.
Privacy policy when data leaves the phone	If anything about the user or their browsing goes to a server, link a policy that says what, why and for how long. Never sell browsing data.
Respect “Disable on this site”	When the user switches you off for a site, don’t run there: no content scripts, no changed requests, no data read.
An honest listing	Name, description and screenshots show what it really does. No pretending to be another brand, no ads or affiliate links injected into sites.

Go through this before you send it. Reviewers do.

The manifest has "pulsar": {"api": 1} (if you use the API), a gecko id you own and a new version.
pulsar.js is unchanged and loaded first.
You answer popup.opening within 400 ms, and the drawer works on Home (host is null).
You follow site.access and hello.disabledSites, and your content scripts check them.
Specs pass without bad_params (check the Pulsar API log in Developer mode).
Background jobs have a clear title and always finish. Schedules are 15 minutes or more and have a reason.
Every screen works in light and dark, at the largest text size, and at 360 px wide.
Touch targets are 48 px. Icon buttons have labels.
No console errors in normal use.
Everything in the description is in the extension, and everything the extension does is in the description.

Reason	Fix
Asks for all sites with no reason	Narrow `host_permissions`, or say in the description why every site is needed.
Keeps running on disabled sites	Store `disabledSites` from `site.access` and check it in content scripts, like the starter does.
Loads code from a server	Bundle every script. Fetching data (JSON) is fine; running fetched code is not.
Data leaves the phone, no privacy policy	Add a policy link, or keep the data on the phone.
Saves video or music from sites that forbid it	Remove the feature.
The listing promises more than it does	Describe what it does today.
Injects ads or affiliate links	Remove them.
A drawer that is mostly empty space, or broken in dark mode	Follow the design guidelines.
An id ending in @pulsarbrowser.com	Use your own domain.

People can report an extension from its store page. Reviewers look at every report.
An extension that breaks a rule can be switched off on every phone in minutes with Pulsar’s kill switch, then removed from the store. You get an email saying why.
Install counts are anonymous: an install or uninstall, never who or where.