Guideline 2.5.2 rejection: Downloading executable code
How the rejection usually reads: "Your app downloads or installs executable code" / "the app includes a mechanism to update itself outside the App Store"
Why it happens
Over-the-air JavaScript updates (Expo Updates, CodePush) are allowed as long as they do not change the app's core purpose or add features that were not reviewed. Reviewers get nervous when they see a JavaScript engine plus an OTA framework plus a vague description. Describe the update mechanism in App Review notes and keep updates to bug fixes and assets.
What can be checked before you submit
1 of RejectProof’s checks map to Guideline 2.5.2. Each one reads your .ipa — no upload — and reports the evidence with a fix.
- Runtime code download / execution risk
PB-16 · guideline 2.5.2 · probable
Make sure the app does not download and run code that changes its core features. Plain JS bundle / asset updates (how React Native / Expo normally work) are usually fine, but dynamically adding native code or features is risky — describe the behavior in your App Review notes.
What a scan cannot tell you
Static checks read the build; they do not run it. Whether a reviewer likes your design, agrees with your content, or considers the app “sufficiently different” is their call. Fix the mechanical layer first so the human review is about your product, not about a missing plist key.