A computer-implemented method includes providing an online marketplace to developers of web applications that may be downloaded from the marketplace to a client computing device for execution by a browser executing on the client device and receiving a request from a party to the marketplace to list a proposed web application for sale in the marketplace. One or more processors of a computer system automatically determine the permissions requested by the proposed web application and automatically determine if the permissions match one or more predetermined permissions. If the permissions match one or more predetermined permissions, then the proposed application is flagged for a manual vetting process before listing the proposed application in the marketplace, and if they do not match, then the proposed application is listed in the marketplace without manual review of the application.