CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)

Browse source
This commit is contained in:
CRTkafa 2026-10-13 05:39:09 +08:00
parent 86cd79dd45
commit 1366e7e231
34 changed files with 881 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

43
cli/lib/project-signals.ts Normal file
View file

@ -0,0 +1,43 @@
// Project signals the console answer sheets use (`console plan`): which ad / attribution SDKs the project has, whether
// the Android manifest (source or the merged one of a local build) requests or removes the advertising ID permission,
// and code that suggests App Privacy types without a Play Data safety equivalent (customer support, AR scanning).
// Pure over the scan facts; null fields mean "not found", never "not scanned" (that is `undefined` signals).
import { grep, type ProjectFacts, where } from './scan/project';
export const AD_ID_PERMISSION = 'com.google.android.gms.permission.AD_ID';
export interface ProjectSignals {
/** Ad SDKs (names) found in the dependencies. */
adSdks: string[];
/** Attribution SDKs (names). */
attributionSdks: string[];
/** SDKs whose own manifest merges the AD_ID permission (names). */
adIdSdks: string[];
/** file:line of the AD_ID permission in a source or merged manifest. */
adIdPermission: string | null;
/** file:line of <uses-permission ... AD_ID tools:node="remove">. */
adIdRemoved: string | null;
/** file:line of a customer support SDK or ticket code (App Privacy "Customer Support"). */
support: string | null;
/** file:line of AR / XR, hand or face tracking code (App Privacy Environment Scanning, Hands, Head). */
ar: string | null;
}
const SUPPORT_DEP = /zendesk|intercom|helpshift|freshchat|freshdesk|crisp-sdk|tawk|gorgias/i;
const SUPPORT_CODE = /\b(createTicket|submitTicket|supportTicket|SupportTicket|contactSupport\s*\()/;
const AR_CODE = /\bARKit\b|\bARSession\b|ARWorldTrackingConfiguration|ARFaceTrackingConfiguration|ARBodyTrackingConfiguration|VNDetectHumanHandPoseRequest|sceneReconstruction|\bnavigator\.xr\b|@react-three\/xr|ARCore|com\.google\.ar\.core|UnityEngine\.XR\.ARFoundation/;
export function projectSignals(p: ProjectFacts): ProjectSignals {
const names = (cat: string) => [...new Set(p.sdks.filter(s => s.sdk.category === cat).map(s => s.sdk.name))];
const perm = p.androidInfo.permissions.find(x => x.name === AD_ID_PERMISSION);
const removed = p.androidInfo.removedPermissions.find(x => x.name === AD_ID_PERMISSION);
const dep = p.deps.find(d => SUPPORT_DEP.test(d.name));
const support = dep ? `${dep.file}:${dep.line}` : grep(p.sources, SUPPORT_CODE, 1).map(h => where(h))[0] ?? null;
const arDep = p.deps.find(d => /arcore|arkit|ar-foundation|arfoundation|react-three\/xr|viro/i.test(d.name));
const ar = arDep ? `${arDep.file}:${arDep.line}` : grep(p.sources, AR_CODE, 1).map(h => where(h))[0] ?? null;
return {
adSdks: names('ads'), attributionSdks: names('attribution'),
adIdSdks: [...new Set(p.sdks.filter(s => s.sdk.mergesAdId).map(s => s.sdk.name))],
adIdPermission: perm ? where(perm.at) : null, adIdRemoved: removed ? where(removed.at) : null, support, ar,
};
}