CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages

Browse source
This commit is contained in:
CRTkafa 2026-10-12 02:03:07 +08:00
parent 179e4d3815
commit 582ea909ca
45 changed files with 625 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

8
skills/privacy-manifest/SKILL.md
View file

@ -7,8 +7,12 @@ description: Add and check Apple privacy manifests (PrivacyInfo.xcprivacy) for a
`storebound scan` runs the same checks as part of its report (no manifest, undeclared required-reason APIs, SDKs older than their first manifest version) and proposes NSPrivacyTracking and the collected data types from the detected SDKs.
Scan: `storebound privacy-manifest --ios ios/App` (local, no credentials). Capacitor / Cordova plugins live outside
the iOS folder: add `--sdk-dirs node_modules/@capacitor,node_modules/<plugin>`. Exit 1 when something blocks upload.
Scan: `storebound privacy-manifest --ios ios/App` (local, no credentials). Capacitor / Cordova / React Native plugins
live outside the iOS folder; they are found the way Node resolves them: the dependencies of the app's package.json
(next to capacitor.config) in the node_modules there and in every folder above it up to the repo root (so a monorepo's
`apps/native/node_modules` works), workspace packages (package.json `workspaces`, Bun / npm / yarn), local SwiftPM
packages (Capacitor 8's CapApp-SPM `Package.swift`), Pods and SwiftPM checkouts. `--sdk-dirs a,b` adds folders it
cannot find. Exit 1 when something blocks upload.
## What Apple checks at upload
- **ITMS-91053 Missing API declaration**: the binary uses a required-reason API and no manifest in the app or in the