scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## Unreleased
+
+Fixes from a real first release of a second game (Capacitor 8 monorepo, lessons 35 to 37):
+
+- Fix (`scan`, review-prompt 3.2.2(x)): a bare "rate" next to "bonus" (`const rate = F.genRate(lv, bonus.gen(r))`) is
+  no longer a reward for rating. The signal needs a rate-us / leave-a-review phrase next to a reward, a reward "for
+  rating / reviewing", or a reward granted within a few lines of a system review prompt call.
+- Fix (`scan`, account findings and the declarations proposal): import, require and export-from lines are never
+  sign-in / sign-up / deletion evidence (`import './buildings/register'` was), auth endpoints must be an absolute path,
+  a URL or a `${base}/...` template, credential fields and guest-account creation count; accounts only the config
+  claims read "from config (accounts.enabled)".
+- Fix (`scan`, 5.1.1(v)): `accounts.inApp` alone no longer clears the finding: without deletion code it stays, medium,
+  "claimed by config (accounts.inApp), not found in code".
+- Fix (`privacy-manifest --propose`): NSPrivacyCollectedDataTypes is built from `appPrivacy.types` (Apple's manifest
+  keys for type and purposes, linked, tracking); NSPrivacyTracking stays true only with app-level domains. `check`
+  warns once when the app manifest's list is empty but `appPrivacy.types` marks types collected.
+- Fix (`console plan apple-app-privacy`): `appPrivacy.types` is authoritative: a type it does not list is "not
+  collected" (certain), never derived from dataSafety or asked. Without it, `appPrivacy.tracking: false` and no ad /
+  attribution SDK answer Advertising Data, Customer Support, Environment Scanning, Hands and Head "not collected"
+  unless a support SDK or AR code is found. `console plan` scans the project for these signals.
+- Fix (`console plan play-advertising-id` / `play-app-content`): "Does your app use advertising ID?" comes from ad /
+  attribution SDKs, the AD_ID permission in the source or merged manifest (or its `tools:node="remove"`),
+  `ads.appAdsTxt` or `console.appContent.advertisingId`; a Data safety Device ID alone is not the advertising ID. No
+  signal: No (certain); signals that disagree: asked.
+- `scan.ignore[].evidence`: accept a finding by the text of an evidence line (`match` keeps matching the title).
+  `scan` and `check` name every entry that matches no finding.
+- Fix (`init`): `.storebound/credentials.json` starts with empty strings only. Placeholder-looking values
+  ("your-…", `<…>`, "xxx", "/absolute/path/to/…", "example") count as missing in every credential read; `check`
+  warns about them and `doctor` lists each credential as set, missing or placeholder.
+
 ## 0.7.1 · 2026-10-13
 
 - Fix: README links and images on npmjs.com resolved against npmjs.com and gave 404 (`docs/README.md`, the logo).