Free Marketplace App: Security and compliance save returns 500

[kiran-firedrill]

I maintain the Firedrill CI GitHub App and am completing its free-only Marketplace draft at https://github.com/marketplace/firedrill-ci/edit. The Security and compliance form at https://github.com/marketplace/firedrill-ci/security_compliance repeatedly returns GitHub's 500 page ("Looks like something went wrong!") when saving. A separate fresh GET confirms that the submitted fields did not persist.

Reproduction on October 20, 2026:

1. Open the Security and compliance section of an existing free-only App listing.
2. Enter the public privacy URL, terms URL, third-party dependencies, private repository visibility and a short factual transparency disclosure.
3. Leave Trader Self-Certification unanswered: the form says the DSA collection does not apply when no payments are processed on GitHub Marketplace, but the classification is also marked required. I have not selected a legal classification merely to get around the form.
4. Click Save listing details. The response is the GitHub 500 page, rather than success or a field-validation message. The same reconciled attempt reproduced later; I have not kept resubmitting.

Contact information, listing description and a Free plan are saved. Two-factor authentication is already Enabled on the owner account (confirmed in account security); no authentication changes are requested. The public organization email also remains pending verification, with no expected verification message found in the monitored business mailboxes.

Is there a supported way to save security disclosures for a free-only App without making an inapplicable trader declaration, or can the Marketplace team investigate this server error? The current support contact flow has no Marketplace technical category, so I am reporting it in Apps, API and Webhooks. This is not a billing dispute and no charge or paid plan is involved. Happy to provide further non-sensitive reproduction details through the correct support route.

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.

[ronitgupta138]

The HTTP 500 server error is caused by a known validation constraint conflict on the EU Digital Services Act (DSA) form handler:

Why It's Throwing a 500 Error

• The backend controller for the Marketplace Security & Compliance form treats the Trader Self-Certification field as a non-nullable database column (NOT NULL).
• While the frontend help text notes that the DSA collection does not apply to free-only apps, leaving the radio option unselected causes the form payload to submit trader_status: null.
• The API handler crashes when attempting to validate or persist this null value, returning GitHub's generic 500 "Something went wrong" page instead of a clean validation warning.

The Workaround

To get the form to persist successfully without misrepresenting your legal standing:

1. Select Non-trader (Self-employed / Individual / Free publisher).
2. The "Non-trader" selection satisfies the mandatory backend enum, requires no VAT / corporate registration numbers, and immediately allows the form to save (200 OK).
3. If your app subsequently adds paid tiers or transitions to commercial sales, you can update this certification under your Marketplace developer settings at any time.