CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

storebound scan: offline rejection-risk scan of the project itself

Browse source 
Detects the stack (native iOS / Android, React Native, Expo, Capacitor, Cordova,
Flutter, Unity, Godot) and the SDKs from a maintained table with versions,
file:line and each vendor's disclosure page, then reports App Store and Google
Play rejection risks with guideline, evidence, fix, severity and skill: 2.1(a)
demo account and placeholder text, 5.1.1(v) account deletion, 4.8 login
services, 3.1.1 restore and outside payments, 3.1.2 subscription info, 5.1.2(i)
ATT, purpose strings, privacy link, privacy manifest, 2.3.10, 2.3.7, 2.3.8, 4.2
web wrappers, 2.5.1, 2.5.5, ATS, export compliance, 1.3 kids ads, review
prompts, privacy labels vs SDKs; Play target SDK 36, delete-account URL, App
access, foreground services, exact alarms, QUERY_ALL_PACKAGES, SMS / call log,
com.example package name.

Proposes Data safety / App Privacy / ATT / privacy manifest answers (detected
file:line or ask owner) as a diff against the config; --write adds only the
detected ones. scan.ignore records owner-accepted findings. MCP tool scan
(read-only), validate includes open findings, desktop Checks tab shows them.
Fixtures for iOS, Android, Capacitor, Unity, Flutter, clean and teaser.
This commit is contained in:
CRTkafa 2026-10-11 23:20:55 +08:00
parent 346d80e07e
commit ae58948abd
109 changed files with 3103 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
skills/account-deletion/SKILL.md
View file

@ -5,6 +5,8 @@ description: Make account deletion pass App Store and Google Play review for an
# Account deletion (both stores)
`storebound scan` finds sign-up and sign-in code (Firebase Auth, Supabase, Google / Facebook / Apple sign-in, custom endpoints) without a deletion path (5.1.1(v)) and accounts without `accounts.deletionUrl` (Play): run it after adding deletion.
Applies to every app that lets people create an account (email, phone, social sign-in, Sign in with Apple). Games
without accounts can skip it. Sources: Apple, "Offering account deletion in your app"
(https://developer.apple.com/support/offering-account-deletion-in-your-app/) and App Review Guideline 5.1.1(v)