Runtime code download / execution risk
Check PB-16 · App Store Review Guideline 2.5.2 · Probable rejection · verified 2026-09-16
Why App Review rejects under Guideline 2.5.2
Over-the-air JavaScript updates (Expo Updates, CodePush) are allowed as long as they do not change the app's core purpose or add features that were not reviewed. Reviewers get nervous when they see a JavaScript engine plus an OTA framework plus a vague description. Describe the update mechanism in App Review notes and keep updates to bug fixes and assets.
How to fix it
Make sure the app does not download and run code that changes its core features. Plain JS bundle / asset updates (how React Native / Expo normally work) are usually fine, but dynamically adding native code or features is risky — describe the behavior in your App Review notes.
How RejectProof detects it
The scan reads your .ipa in the browser (or locally with npx rejectproof): Info.plist, entitlements, the privacy manifest, embedded frameworks and the executable itself. Check PB-16 reports the exact evidence it found — the key, the symbol, the file or the URL — so you can confirm it in your own project before changing anything. Nothing is uploaded; only a small redacted summary is sent to build the report, and you see it first.