scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)

tests/fixtures/scan/capacitor-game/src/economy.ts

@@ -0,0 +1,11 @@
+export const bonus = { gen: (r: number) => 1 + r * 0.1 };
+export const F = {
+  genRate: (lv: number, mult: number) => lv * 2 * mult,
+};
+
+export function tick(f: typeof F, lv = 1, r = 0): number {
+  const rate = F.genRate(lv, bonus.gen(r));
+  const frameRate = 60; // bonus coins drop every second
+  const exchangeRate = 10; // coins per gem
+  return rate * frameRate / exchangeRate;
+}