Xcode Project
Local static analysis.
Source: Xcode project (local, no network). These checks run even without App Store Connect credentials. The analyzer parses project.pbxproj directly and resolves the Release build settings for the app target, reads the Info.plist, and scans your sources.
Project settings not fully resolved
ID: settings-unresolved · Can be: Info
Emitted only when the static parse couldn’t fully resolve settings — an .xcconfig base configuration, or unexpanded $(…) / ${…} variables in Bundle identifier, Marketing version, SDKROOT, Info.plist path, or Device family. Warns that dependent checks may be inaccurate; verify those values in Xcode.
Usage strings
ID: usage-strings · Can be: Blocking, Passed
Cross-references privacy-sensitive APIs found in your code against the Info.plist purpose-string keys.
| API tokens | Required key |
|---|---|
AVCaptureDevice, AVCaptureSession | NSCameraUsageDescription |
AVAudioRecorder, requestRecordPermission, AVAudioApplication | NSMicrophoneUsageDescription |
PHPhotoLibrary, PHPickerViewController, UIImagePickerController | NSPhotoLibraryUsageDescription |
CLLocationManager | NSLocationWhenInUseUsageDescription |
CNContactStore | NSContactsUsageDescription |
ATTrackingManager | NSUserTrackingUsageDescription |
EKEventStore | NSCalendarsUsageDescription |
CMMotionManager | NSMotionUsageDescription |
- Passed — every referenced API has its Info.plist purpose string.
- Blocking — a referenced API is missing its string. The app will be rejected (or crash on first use).
Encryption key in Info.plist
ID: encryption-key · Can be: Recommended, Passed
Checks for ITSAppUsesNonExemptEncryption in the Info.plist.
- Passed — the key is set.
- Recommended — not found. Without it, every upload prompts the compliance question and can hold in Missing Compliance (see the ASC-side Export compliance check).
App icon set
ID: icon-set · Can be: Recommended, Passed
Locates AppIcon.appiconset in the asset catalog and reads its Contents.json.
- Passed — the icon slots are filled.
- Recommended — no
AppIcon.appiconsetfound, or it exists but has no image files. The App Store requires a complete icon.
Privacy manifest
ID: privacy-manifest · Can be: Recommended, Passed
Walks the project for a PrivacyInfo.xcprivacy file.
- Passed — a privacy manifest is included.
- Recommended — none found. Apple requires a privacy manifest for apps that call Required Reason APIs (file timestamps, system boot time, available disk space, active keyboards,
UserDefaults) or embed listed third-party SDKs. Uploading without one draws an email warning and can be rejected.
Unused entitlements
ID: unused-entitlements · Can be: Recommended, Passed
Cross-references capability entitlements declared in the .entitlements file against matching framework usage in your code. Conservative — only entitlements with an unambiguous code signal are considered; configuration-driven entitlements (App Groups, Associated Domains, Keychain Sharing) are deliberately excluded to avoid false positives.
| Entitlement | Framework tokens |
|---|---|
com.apple.developer.healthkit | HKHealthStore, HKQuantityType, HealthKit |
com.apple.developer.homekit | HMHomeManager, HMAccessory, HomeKit |
com.apple.developer.in-app-payments | PKPaymentAuthorizationController, PKPaymentRequest, PKPaymentButton |
com.apple.developer.icloud-container-identifiers | CKContainer, CKDatabase, NSUbiquitousKeyValueStore |
com.apple.developer.networking.vpn.api | NEVPNManager, NETunnelProviderManager, NEVPNProtocol |
com.apple.developer.networking.HotspotConfiguration | NEHotspotConfiguration |
- Passed — every mapped entitlement has matching code.
- Recommended — an entitlement is declared but its framework isn’t referenced. App Review challenges capabilities an app doesn’t use, and unused entitlements can hold up approval (2.5.x). Emitted only when the target declares at least one mappable entitlement.
Web view (minimum functionality)
ID: min-functionality · Can be: Info
Emitted only when your code references a web view (WKWebView, UIWebView, or WebView(). A heads-up for guideline 4.2: an app that is mainly a wrapper around a website can be rejected for insufficient native functionality. A web view used for help, a purchase flow, or embedded content is fine — this never blocks.
Targeted platform / device family
ID: device-family · Can be: Info
- On macOS (
SDKROOT = macosx): reports “macOS”. - On iOS: reports
TARGETED_DEVICE_FAMILY(iPhone, iPad, or both). This also drives whether missing iPad screenshots are blocking in Version & Metadata.
Deployment target
ID: deployment-target · Can be: Info
Reports the minimum OS version (MACOSX_DEPLOYMENT_TARGET or IPHONEOS_DEPLOYMENT_TARGET).
Cross-checks (live mode only)
These run only when both a project and App Store Connect credentials are present, comparing local project values against the live app.
Bundle ID match
ID: bundle-match · Can be: Blocking, Passed
Compares the project’s PRODUCT_BUNDLE_IDENTIFIER against the ASC app’s bundle id.
- Passed — they match.
- Blocking — they differ. Uploads won’t attach to this app record.
Version match
ID: version-match · Can be: Recommended, Passed
Compares MARKETING_VERSION against the ASC editable version.
- Passed — they match.
- Recommended — they differ. The build you archive may attach to the wrong version. (
agvtool new-marketing-version <version>.)
NOTE
The analyzer also feeds two other categories: the privacy capabilities it detects power the App Privacy cross-check, and the app-type profile it infers gates the Review Guidelines checklist.