Auditing App Store Compliance

App Store Compliance Audit

Perform a systematic App Store compliance audit covering all 5 Apple guideline categories. Produces actionable GitHub issue with specific findings, file paths, and confidence levels.

Scope (optional): $ARGUMENTS

If no scope is provided, "all" is assumed.

Core principle: Thorough audit regardless of time pressure, scope narrowing, or past approval history. All 5 categories. GitHub issue output. No shortcuts.

Step 1: Audit Scope Validation

Mandatory requirements that CANNOT be skipped:

1. All 5 categories: Safety, Performance, Business, Design, Legal
2. GitHub issue output: Structured issue with checkboxes
3. Specific locations: File paths and line numbers for all findings
4. Confidence levels: Certain/Likely/Possible for each finding

Red flags - if you catch yourself thinking any of these, STOP:

• "Quick check is fine given the timeline" → Full audit. Same process.
• "They just want privacy checked" → All 5 categories. Always.
• "They passed review before" → Previous approval is irrelevant.
• "Don't need GitHub issue, just tell them" → Issue is mandatory.
• "This seems simple" → Follow checklist completely.

Step 2: Audit Safety Guidelines (1.x)

Guideline Categories:

• 1.1 Objectionable Content
• 1.2 User Generated Content
• 1.3 Kids Category
• 1.4 Physical Harm
• 1.5 Developer Information
• 1.6 Data Security

2.1 Search for content moderation mechanisms

# Check for content reporting/moderation
grep -ri "report\|block\|moderate\|flag" --include="*.swift" | head -20

# Check for UGC features without moderation
grep -ri "comment\|post\|upload\|share" --include="*.swift" | head -20

2.2 Check Kids Category requirements (if applicable)

# Check for advertising SDKs (not allowed in Kids)
grep -ri "AdMob\|Facebook.*Ad\|Unity.*Ads" --include="*.swift" | head -10

# Check for analytics that collect data
grep -ri "Analytics\|tracking\|IDFA" --include="*.swift" | head -10

# Check for external links (restricted in Kids)
grep -ri "openURL\|SFSafariViewController\|WKWebView" --include="*.swift" | head -10

2.3 Check for physical harm content

# Medical/health claims that need verification
grep -ri "cure\|treat\|diagnose\|medical\|health" --include="*.swift" | head -10

# Check for drug-related content
grep -ri "drug\|medication\|dose\|prescription" --include="*.swift" | head -10

2.4 Verify developer information

• Check Info.plist for valid support URL
• Verify App Store Connect contact information is complete

Report findings as:

Safety (1.x) Issues:
- [ ] **[Confidence]** {Issue} (Guideline 1.X.X)
  - Location: `path/file.swift:123`
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 3: Audit Performance Guidelines (2.x)

Guideline Categories:

• 2.1 App Completeness
• 2.2 Beta, Demo, Trial, and Test Versions
• 2.3 Accurate Metadata
• 2.4 Hardware Compatibility
• 2.5 Software Requirements

3.1 Search for placeholder/test content

# Placeholder content
grep -ri "lorem\|placeholder\|coming soon\|TBD\|TODO" --include="*.swift" | head -20

# Test/debug indicators in production code
grep -ri "test" --include="*.swift" | grep -v "Tests/" | grep -v "XCTest" | head -20

# Debug code
grep -ri "debug\|#if DEBUG" --include="*.swift" | head -20

# TODO/FIXME markers
grep -ri "TODO\|FIXME\|XXX\|HACK" --include="*.swift" | head -20

# Console logging that should be removed
grep -ri "print(\|NSLog\|debugPrint" --include="*.swift" | grep -v "Tests/" | head -20

3.2 Check for incomplete features

# Disabled buttons or features
grep -ri "isEnabled.*false\|disabled\|NotImplemented" --include="*.swift" | head -10

# Empty implementations
grep -ri "fatalError\|preconditionFailure\|assertionFailure" --include="*.swift" | head -10

3.3 Verify metadata accuracy

• Screenshots must show actual app functionality
• App description must match actual features
• No references to other platforms (Android, Windows)

3.4 Check hardware requirements

# Verify UIRequiredDeviceCapabilities
grep -A5 "UIRequiredDeviceCapabilities" */Info.plist

3.5 Software requirements check

# Check for deprecated APIs
grep -ri "@available.*deprecated" --include="*.swift" | head -10

# Check minimum deployment target
grep "IPHONEOS_DEPLOYMENT_TARGET" project.yml *.xcconfig 2>/dev/null

Report findings as:

Performance (2.x) Issues:
- [ ] **[Confidence]** {Issue} (Guideline 2.X.X)
  - Location: `path/file.swift:123`
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 4: Audit Business Guidelines (3.x)

Guideline Categories:

• 3.1 Payments (In-App Purchase)
• 3.2 Other Business Model Issues

4.1 Check In-App Purchase implementation

# StoreKit usage
grep -ri "StoreKit\|SKProduct\|Product\|purchase\|subscription" --include="*.swift" | head -20

# Check for StoreKit 2 (preferred) vs StoreKit 1 (deprecated)
grep -ri "SKPaymentQueue\|SKProductsRequest" --include="*.swift" | head -10

# Restore purchases mechanism
grep -ri "restore\|currentEntitlements\|AppStore.sync" --include="*.swift" | head -10

4.2 Verify subscription requirements

# Subscription disclosure
grep -ri "subscription\|renew\|billing\|cancel" --include="*.swift" | head -10

# Check for subscription terms display
grep -ri "terms\|conditions\|privacy.*policy" --include="*.swift" | head -10

4.3 Check for cryptocurrency/NFT features

# Crypto/NFT content
grep -ri "crypto\|bitcoin\|ethereum\|NFT\|blockchain\|wallet" --include="*.swift" | head -10

4.4 Verify advertising implementation

# Ad SDK usage
grep -ri "AdMob\|GAD\|Facebook.*Ad\|Unity.*Ads\|AppLovin" --include="*.swift" | head -10

# IDFA/ATT usage
grep -ri "IDFA\|advertisingIdentifier\|ATTrackingManager" --include="*.swift" | head -10

Report findings as:

Business (3.x) Issues:
- [ ] **[Confidence]** {Issue} (Guideline 3.X.X)
  - Location: `path/file.swift:123`
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 5: Audit Design Guidelines (4.x)

Guideline Categories:

• 4.1 Copycats
• 4.2 Minimum Functionality
• 4.3 Spam
• 4.4 Extensions
• 4.5 Apple Sites and Services
• 4.6 Alternate App Icons
• 4.7 HTML5 Games, Bots, etc.

5.1 Check for minimum functionality

• App must provide value beyond a simple website wrapper
• Must have sufficient features for standalone app
• No placeholder or "coming soon" screens

5.2 Check extension guidelines

# App extensions
grep -ri "NSExtension" */Info.plist
ls -la */Extensions/ 2>/dev/null

# Widget configuration
grep -ri "WidgetKit\|TimelineProvider" --include="*.swift" | head -10

5.3 Check Apple service usage

# Sign in with Apple (required if social logins present)
grep -ri "ASAuthorization\|SignInWithApple\|ASAuthorizationAppleIDProvider" --include="*.swift" | head -10

# Other social logins (SIWA required if these exist)
grep -ri "Google.*SignIn\|Facebook.*Login\|Twitter.*Login" --include="*.swift" | head -10

5.4 Check for App Clip requirements (if applicable)

# App Clip target
grep -ri "app-clip\|AppClip" project.yml *.xcconfig 2>/dev/null

# App Clip size (must be under 50MB for digital, 15MB for physical)

Report findings as:

Design (4.x) Issues:
- [ ] **[Confidence]** {Issue} (Guideline 4.X.X)
  - Location: `path/file.swift:123`
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 6: Audit Legal Guidelines (5.x)

Guideline Categories:

• 5.1 Privacy (CRITICAL - Most common rejection cause)
• 5.2 Intellectual Property
• 5.3 Gaming, Gambling, and Lotteries
• 5.4 VPN Apps
• 5.5 Mobile Device Management
• 5.6 Developer Code of Conduct

6.1 Privacy Manifest Validation (CRITICAL)

Check for PrivacyInfo.xcprivacy at bundle root:

# Find privacy manifest
find . -name "PrivacyInfo.xcprivacy" -type f

# Verify required keys exist
grep -E "NSPrivacyTracking|NSPrivacyTrackingDomains|NSPrivacyCollectedDataTypes|NSPrivacyAccessedAPITypes" */PrivacyInfo.xcprivacy

Required privacy manifest structure:

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array/>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <!-- Each API type with reasons -->
    </array>
</dict>
</plist>

6.2 Required Reason API Detection

Search for APIs that require declaration in privacy manifest:

# UserDefaults (requires CA92.1 or 1C8F.1)
grep -r "UserDefaults" --include="*.swift" --include="*.m" | head -10

# File Timestamps (requires DDA9.1, C617.1, or 3B52.1)
grep -rE "(creationDate|modificationDate|getattrlist|stat\(|fstat\(|lstat\()" --include="*.swift" | head -10

# System Boot Time (requires 35F9.1 or 8FFB.1)
grep -rE "(systemUptime|mach_absolute_time)" --include="*.swift" | head -10

# Disk Space (requires 85F4.1 or E174.1)
grep -rE "(volumeAvailableCapacity|systemFreeSize|statfs|statvfs)" --include="*.swift" | head -10

# Active Keyboards (requires 3EC4.1 or 54BD.1)
grep -rE "activeInputModes" --include="*.swift" | head -10

6.3 Info.plist Usage Description Verification

Check all required usage descriptions:

# Extract all NS*UsageDescription keys
grep -E "NS.*UsageDescription" */Info.plist

Required keys based on API usage:

# Check for APIs without corresponding usage descriptions
# Camera
grep -ri "AVCaptureSession\|UIImagePickerController.*camera" --include="*.swift" | head -5

# Microphone
grep -ri "AVAudioRecorder\|AVAudioSession.*record" --include="*.swift" | head -5

# Photos
grep -ri "PHPhotoLibrary\|UIImagePickerController" --include="*.swift" | head -5

# Location
grep -ri "CLLocationManager\|CoreLocation" --include="*.swift" | head -5

# Contacts
grep -ri "CNContactStore\|Contacts" --include="*.swift" | head -5

# HealthKit
grep -ri "HKHealthStore\|HealthKit" --include="*.swift" | head -5

# Face ID
grep -ri "LAContext\|LocalAuthentication" --include="*.swift" | head -5

6.4 Privacy Policy Verification

# Check for privacy policy URL
grep -ri "privacy.*policy\|privacyPolicy" */Info.plist --include="*.swift" | head -5

# Check App Store Connect metadata (manual verification required)

6.5 Account Deletion Requirement (Mandatory since 2022)

# Check for account deletion mechanism
grep -ri "delete.*account\|deleteAccount\|removeAccount" --include="*.swift" | head -10

6.6 App Tracking Transparency (if tracking)

# Check ATT implementation
grep -ri "ATTrackingManager\|requestTrackingAuthorization" --include="*.swift" | head -10

# Check IDFA usage
grep -ri "advertisingIdentifier\|IDFA" --include="*.swift" | head -10

6.7 Data Collection Disclosure

# Check for analytics SDKs
grep -ri "Firebase.*Analytics\|Mixpanel\|Amplitude\|Segment" --include="*.swift" | head -10

# Check for third-party SDKs requiring disclosure
grep -ri "Facebook\|Google\|Twitter\|TikTok" --include="*.swift" | head -10

Report findings as:

Legal (5.x) Issues:
- [ ] **[Confidence]** {Issue} (Guideline 5.X.X)
  - Location: `path/file.swift:123`
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 7: Build and Binary Verification

7.1 Check Xcode version requirement

# After April 24, 2025: Xcode 16+ and iOS 18 SDK required
xcodebuild -version

7.2 Verify code signing

# Verify code signature (run on built app)
codesign -vvv --deep --strict *.app 2>&1 | head -20

# View entitlements
codesign -d --entitlements - *.app 2>&1 | head -30

# Check provisioning profile
security cms -D -i */embedded.mobileprovision 2>&1 | head -50

7.3 Validate Info.plist

# Lint Info.plist
plutil -lint */Info.plist

# Check export compliance
grep "ITSAppUsesNonExemptEncryption" */Info.plist

7.4 Check architectures

# Verify arm64 architecture
lipo -info *.app/* 2>/dev/null | grep -v "is not an object" | head -10

7.5 Check app size constraints

# Maximum app size: 4 GB uncompressed
# Maximum executable: 500 MB
# Cellular download threshold: 200 MB

# Check bundle size
du -sh *.app 2>/dev/null

7.6 Check APNs environment

# Verify production (not development) for release
grep "aps-environment" *.entitlements */embedded.mobileprovision 2>/dev/null

Report findings as:

Build/Binary Issues:
- [ ] **[Confidence]** {Issue}
  - Problem: {Specific issue}
  - Resolution: {Actionable fix}

Step 8: Third-Party SDK Compliance

8.1 Check for SDKs requiring privacy manifests

Apple's list of 86+ SDKs requiring privacy manifests includes:

Facebook/Meta:

• FBSDKCoreKit, FBSDKLoginKit, FBSDKShareKit, FBAEMKit

Firebase:

• FirebaseCore, FirebaseAuth, FirebaseCrashlytics, FirebaseMessaging, FirebaseAnalytics

Google:

• GoogleSignIn, GoogleUtilities, GTMSessionFetcher

Popular Libraries:

• Alamofire, AFNetworking, SDWebImage, Kingfisher, Lottie, SnapKit, RealmSwift, RxSwift

# Check Podfile for common SDKs
grep -E "Firebase|Facebook|Google|Alamofire|SDWebImage|Kingfisher|Lottie|SnapKit|Realm|RxSwift" Podfile 2>/dev/null

# Check Package.swift
grep -E "firebase|facebook|google|alamofire|sdwebimage|kingfisher|lottie|snapkit|realm|rxswift" Package.swift 2>/dev/null

# Check for privacy manifests in Pods
find Pods -name "PrivacyInfo.xcprivacy" 2>/dev/null | head -20

8.2 Generate privacy report

After archiving in Xcode:
Product → Archive → Right-click archive → Generate Privacy Report

Report findings as:

Third-Party SDK Issues:
- [ ] **[Confidence]** {SDK} missing privacy manifest
  - Resolution: Update to version X.X.X or later

Step 9: Create GitHub Issue

See ./github-issue-template.md for the complete issue template with:

• Summary table by category
• Critical issues, warnings, recommendations sections
• Pre-submission checklist
• Confidence levels reference

Reference Documents

For detailed reference material, see:

• ./app-store-reference-tables.md — Confidence levels, rejection causes, policy timeline, binary limits, screenshot requirements, entitlements, and Required Reason API codes
• ./github-issue-template.md — GitHub issue template for audit results