CRT/storebound

CRT 1366e7e231 scan, privacy answers and credentials from a second game's first release (lessons 35-37): review-prompt needs rating context, not a bare "rate"; account signals skip import lines and module paths, config-only accounts say "from config"; accounts.inApp without deletion code stays a medium 5.1.1(v) finding; privacy-manifest --propose builds NSPrivacyCollectedDataTypes from appPrivacy.types and check warns on an empty list; appPrivacy.types is authoritative in the App Privacy sheet (unlisted = not collected), ad / support / AR types default to not collected without tracking or ad SDKs; Play advertising ID from SDKs, the AD_ID permission, app-ads.txt or the flag, never from a Device ID alone; scan.ignore[].evidence and warnings for entries that match nothing; empty credentials template, placeholder values count as missing (check, doctor)

2026-10-13 05:39:09 +08:00

524 B

Raw Blame History

capacitor-game fixture

A made-up Capacitor 8 farm game (first release) with the patterns a real-use report found: a module named buildings/register imported for its side effects, production rates next to a bonus object, accounts and in-app deletion claimed only by the config (no auth or deletion code), five App Privacy types in appPrivacy.types while the app's PrivacyInfo.xcprivacy lists none, a random install id declared as Device ID in Data safety, and no ad SDK or AD_ID permission. Not a buildable project.