CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

storebound scan: offline rejection-risk scan of the project itself

Browse source 
Detects the stack (native iOS / Android, React Native, Expo, Capacitor, Cordova,
Flutter, Unity, Godot) and the SDKs from a maintained table with versions,
file:line and each vendor's disclosure page, then reports App Store and Google
Play rejection risks with guideline, evidence, fix, severity and skill: 2.1(a)
demo account and placeholder text, 5.1.1(v) account deletion, 4.8 login
services, 3.1.1 restore and outside payments, 3.1.2 subscription info, 5.1.2(i)
ATT, purpose strings, privacy link, privacy manifest, 2.3.10, 2.3.7, 2.3.8, 4.2
web wrappers, 2.5.1, 2.5.5, ATS, export compliance, 1.3 kids ads, review
prompts, privacy labels vs SDKs; Play target SDK 36, delete-account URL, App
access, foreground services, exact alarms, QUERY_ALL_PACKAGES, SMS / call log,
com.example package name.

Proposes Data safety / App Privacy / ATT / privacy manifest answers (detected
file:line or ask owner) as a diff against the config; --write adds only the
detected ones. scan.ignore records owner-accepted findings. MCP tool scan
(read-only), validate includes open findings, desktop Checks tab shows them.
Fixtures for iOS, Android, Capacitor, Unity, Flutter, clean and teaser.
This commit is contained in:
CRTkafa 2026-10-11 23:20:55 +08:00
parent 346d80e07e
commit ae58948abd
109 changed files with 3103 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
skills/privacy-manifest/SKILL.md
View file

@ -5,6 +5,8 @@ description: Add and check Apple privacy manifests (PrivacyInfo.xcprivacy) for a
# Privacy manifest (iOS)
`storebound scan` runs the same checks as part of its report (no manifest, undeclared required-reason APIs, SDKs older than their first manifest version) and proposes NSPrivacyTracking and the collected data types from the detected SDKs.
Scan: `storebound privacy-manifest --ios ios/App` (local, no credentials). Capacitor / Cordova plugins live outside
the iOS folder: add `--sdk-dirs node_modules/@capacitor,node_modules/<plugin>`. Exit 1 when something blocks upload.