scan: remote config, feature flags and remote paywalls not told to review (App Review 2.3.1, Play Deceptive behavior): remote-features finding for both stores, medium, with deep links, unless the review notes mention them; check prints it as a warning, validate carries it; warn only, the templates get a commented example line; code obfuscators a low note, minify alone nothing; store-pitfalls 74

skills/review-rejections/SKILL.md

@@ -87,6 +87,9 @@ Plain, polite, specific; one guideline per paragraph; no blame, no threats, no "
 - **2.3 Accurate metadata**: screenshots must show the real app (for a game: real gameplay); no prices, no "free"
   claims for paid items, no other platforms' UI; keywords without competitor names; age rating answers that match
   the content.
+- **2.3.1 Hidden or undocumented features** (Play: Deceptive behavior): remote config, feature flags or a remote
+  paywall the review notes did not mention (`storebound scan` rule `remote-features`, store-pitfalls 74). Fix: say in
+  the notes which SDK changes what remotely; a business-model change needs a new review and a description update.
 - **3.1.1 In-app purchase**: digital goods only through IAP; a visible **Restore Purchases** for non-consumables;
   no links to outside payment; loot boxes must show odds.
 - **3.1.2 Subscriptions**: the purchase screen shows title, length, price per period and what the user gets; links to

skills/store-pitfalls/SKILL.md

@@ -877,3 +877,25 @@ that fails without the fix (see CONTRIBUTING.md).
   in-app purchases and no `reviewAccess.instructions`, and when the steps are longer than 500 characters
   (`cli/lib/profile.ts`). The plan's guest path is in `cli/lib/console-play-plans.ts` (`signInDetails`);
   `tests/guest-login-wall.test.ts`.
+
+## 74. Remote config and remote paywalls read as hidden features (2.3.1)
+- **Symptom:** App Review rejects or removes an app under Guideline 2.3.1 (hidden, dormant or undocumented features),
+  or Play flags Deceptive behavior, after a feature or a hard paywall was switched on remotely, or the reviewer saw a
+  different paywall than the one users get.
+- **Cause:** remote config / feature flag SDKs (Firebase Remote Config, Statsig, LaunchDarkly, GrowthBook, Optimizely,
+  PostHog feature flags, Unleash, ConfigCat, Amplitude Experiment, Split) and remote paywalls (RevenueCat Paywalls,
+  Superwall, Adapty, Qonversion, Purchasely, Apphud) change what the app does after review, and the review notes said
+  nothing. Paywall tests and designs are not features and are fine once App Review knows; a business-model change
+  (soft -> hard paywall, freemium -> premium, features moved behind a subscription) or functionality enabled after
+  review is a feature change.
+- **Do:** this is the developer's call; storebound only warns. Suggest a line in `apple.info.reviewNotes` (and
+  `reviewAccess.instructions`, which also go to Play App access) that names the SDK and what changes remotely
+  (paywall designs, prices shown, which flags), document every feature that can be switched on or off, and send a
+  business-model change as a new review with a description that discloses what needs a paid subscription. Never
+  write the note into the developer's config or code yourself.
+- **Guard:** `storebound scan` (and `validate`, which runs it; `check` prints it as a warning) reports `remote-features`
+  for Apple (2.3.1) and Play (Deceptive behavior), medium, with the deep links, unless the review notes mention remote
+  config, a feature flag, A/B, a paywall test, an experiment or "remotely" (`remoteFeatureFindings` in
+  `cli/lib/scan/rules.ts`, the SDK table `REMOTE_SDKS` in `cli/lib/scan/sdks.ts`). A code obfuscator (DexGuard,
+  iXGuard, a JavaScript obfuscator) is a low `obfuscation` note; ProGuard / R8 minify alone is never reported.
+  `tests/remote-features.test.ts`.

skills/store-subscriptions/SKILL.md

@@ -59,6 +59,9 @@ offers, offerCodes, reviewScreenshot, basePlanId, gracePeriod, platforms }] }]`,
   Agreement; the privacy policy URL field (`storebound apple listing`). `validate` warns when a description has no
   Terms link. 3.1.2(a): a subscription must give ongoing value and last at least 7 days.
 - Review notes: where the paywall is, that the demo account can buy in the sandbox (`review-access`).
+- Remote paywalls (RevenueCat Paywalls, Superwall, Adapty, Qonversion, Purchasely, Apphud) or flags: say in the review
+  notes that paywall designs / prices shown change remotely (2.3.1, `scan` warns; store-pitfalls 74); moving features
+  behind the subscription after review needs a new review and a description that discloses it.
 
 ## Gotchas
 - A product id, a billing period or a subscription's group cannot change; make a new id.