Trust & safety
Buying and selling code should feel safe.
Cinderella is built around one worry on each side: a seller shouldn't leak secrets, and a buyer shouldn't get burned. Here's exactly how we handle both.
🧼 Every upload is scrubbed
Before a repo can list, an automated scrubber removes .env files, API keys, credentials, database dumps, and personal data, replacing them with safe placeholders. It emits a report you can read on the listing, and anything it can't safely clean is held for human review instead of going live. It never touches your git history — the bundle a buyer receives is the cleaned one.
🔒 Payments are held in escrow
A buyer's money is held, not sent straight to the seller. It's released only after the buyer confirms the hand-off — or automatically after the inspection window — so a seller can't vanish with the payment and a buyer can't receive the goods and stiff the seller. See Pricing & fees for the timing.
⭐ Sellers build a public reputation
After each completed sale, the buyer rates the seller 1–5. Those reviews aggregate into a star rating shown on the seller's listings and their public seller profile — so a track record is visible before you buy.
🤫 Ideas stay confidential until you agree to look
A raw idea has a public teaser and a protected full pitch that never ships in the page source. It unlocks only after you sign in and acknowledge confidentiality, and the seller gets a logged trail of who accessed it — so concepts aren't free to lift.
🚩 Report anything that looks wrong
Every listing has a report link for copyright, stolen code, or misrepresented ownership. Reports go straight to a moderation queue, and clear infringement is taken down. If something seems off, tell us — we'd rather hear it.
📄 The fine print, in plain sight
Ownership terms (full, exclusive, or non-exclusive) are stated on every listing. Our Terms, Seller Agreement, Acceptable Use, Scrub Disclaimer, and Privacy Policy spell out the rest. The scrubber is a strong safety net, not a guarantee — sellers are still responsible for what they upload.