Free, and it takes about a minute.
Lowercase letters, numbers and underscores.
We read each package's manifest ourselves, record its checksum, and re-verify it every single time it is served. If a file ever stops matching what the developer uploaded, we refuse to serve it.
