How CodeValue Works
From repository to verified listing — every step evidenced, verifiable, and transparent.
Turn Your Repository Into Revenue
Connect Your GitHub
Sign in with GitHub and pick the repository and branch you want valued. Private repositories are supported; your repository name stays private unless you choose to show it. Source is downloaded only temporarily for analysis and is not retained afterwards.
Evidence-Based Analysis
We download the repository at a pinned commit into temporary storage and build an evidence manifest: every file hashed, languages and size, dependencies from every manifest and lockfile, known vulnerabilities (OSV), licences, secret and risky-pattern scans, tests, CI and documentation. We never execute your code. The working copy is deleted when analysis finishes. Each evaluation costs 1 credit — your first 3 credits are free, and a failed evaluation’s credit is returned.
Review Your Score
You receive the CodeValue Technical Index (0–100) computed by a published, versioned specification, an experimental indicative price range, and an Ed25519-signed certificate that binds the exact commit, evidence and methodology. AI writes the description; it never sets the score.
Set Your Price & List
Review and edit the generated description, set your price and define what the sale transfers. Nothing is published until you approve it. Your source code is never exposed.
Find Verified Codebases With Confidence
Browse & Search
Filter by tech stack, language, score range, and price. Every assessed listing shows its evidence: dependencies and vulnerabilities, tests, structure, documentation, scan completeness, and the signed certificate.
Check the Certificate
Every assessed listing links to its certificate. Verify the signature yourself, and if you later receive the code, check that it matches the certified source tree.
Security Is Not a Feature. It’s the Foundation.
Never Executed
Your code is read by static analysers, never run on our servers, and the working copy is deleted when the analysis finishes.
SHA-256 Integrity
Each certificate records a SHA-256 hash of the certified source tree, so anyone who later holds the code can check it against the certificate.
Signed Certificates
Ed25519-signed certificates bind the commit, source hashes, evidence manifest and methodology versions. Verify them with the public key — no trust in CodeValue required.