CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: remote config, feature flags and remote paywalls not told to review (App Review 2.3.1, Play Deceptive behavior): remote-features finding for both stores, medium, with deep links, unless the review notes mention them; check prints it as a warning, validate carries it; warn only, the templates get a commented example line; code obfuscators a low note, minify alone nothing; store-pitfalls 74

Browse source
This commit is contained in:
CRTkafa 2026-10-18 01:26:32 +08:00
parent 9ba97b7e29
commit 61cb3338e8
13 changed files with 258 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

22
skills/store-pitfalls/SKILL.md
View file

@ -877,3 +877,25 @@ that fails without the fix (see CONTRIBUTING.md).
in-app purchases and no `reviewAccess.instructions`, and when the steps are longer than 500 characters
(`cli/lib/profile.ts`). The plan's guest path is in `cli/lib/console-play-plans.ts` (`signInDetails`);
`tests/guest-login-wall.test.ts`.
## 74. Remote config and remote paywalls read as hidden features (2.3.1)
- **Symptom:** App Review rejects or removes an app under Guideline 2.3.1 (hidden, dormant or undocumented features),
or Play flags Deceptive behavior, after a feature or a hard paywall was switched on remotely, or the reviewer saw a
different paywall than the one users get.
- **Cause:** remote config / feature flag SDKs (Firebase Remote Config, Statsig, LaunchDarkly, GrowthBook, Optimizely,
PostHog feature flags, Unleash, ConfigCat, Amplitude Experiment, Split) and remote paywalls (RevenueCat Paywalls,
Superwall, Adapty, Qonversion, Purchasely, Apphud) change what the app does after review, and the review notes said
nothing. Paywall tests and designs are not features and are fine once App Review knows; a business-model change
(soft -> hard paywall, freemium -> premium, features moved behind a subscription) or functionality enabled after
review is a feature change.
- **Do:** this is the developer's call; storebound only warns. Suggest a line in `apple.info.reviewNotes` (and
`reviewAccess.instructions`, which also go to Play App access) that names the SDK and what changes remotely
(paywall designs, prices shown, which flags), document every feature that can be switched on or off, and send a
business-model change as a new review with a description that discloses what needs a paid subscription. Never
write the note into the developer's config or code yourself.
- **Guard:** `storebound scan` (and `validate`, which runs it; `check` prints it as a warning) reports `remote-features`
for Apple (2.3.1) and Play (Deceptive behavior), medium, with the deep links, unless the review notes mention remote
config, a feature flag, A/B, a paywall test, an experiment or "remotely" (`remoteFeatureFindings` in
`cli/lib/scan/rules.ts`, the SDK table `REMOTE_SDKS` in `cli/lib/scan/sdks.ts`). A code obfuscator (DexGuard,
iXGuard, a JavaScript obfuscator) is a low `obfuscation` note; ProGuard / R8 minify alone is never reported.
`tests/remote-features.test.ts`.