scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)

tests/fixtures/scan/capacitor-game/README.md

@@ -0,0 +1,7 @@
+# capacitor-game fixture
+
+A made-up Capacitor 8 farm game (first release) with the patterns a real-use report found: a module named
+`buildings/register` imported for its side effects, production rates next to a `bonus` object, accounts and in-app
+deletion claimed only by the config (no auth or deletion code), five App Privacy types in `appPrivacy.types` while the
+app's PrivacyInfo.xcprivacy lists none, a random install id declared as Device ID in Data safety, and no ad SDK or
+AD_ID permission. Not a buildable project.