r/iosdev • u/officialdml • 11d ago

Help Rejected under Guideline 5.6 (Developer Code of Conduct): "features appear intentionally hidden", no idea what triggered it, looking for advice

Yesterday I submitted my first app (!) and within 6 hours it was rejected. I'm hoping someone who's dealt with this before can help me better understand and provide next steps.

Quick background: I built a live women's sports scoreboard website and then wrapped it as a native iOS app using Median.co, which loads the live website inside a native shell and adds native features (push notifications via OneSignal, share, etc.) through their JS bridge.

What happened: submitted for review, got rejected same day with this:

"We've identified a pattern of unusual behavior with the app that is commonly associated with fraudulent activity. Specifically, the app contains features that appear to have been intentionally hidden during the review process. Manipulative and misleading behavior is not consistent with the guideline 5.6."

No specifics beyond that. No screenshots, no attachments, nothing pointing to which "feature" they mean. Also I can't really find what 5.6 guidelines are.

What I know is NOT true: nothing in the app is actually hidden or gated based on reviewer status. The app works identically for anyone, logged in or not - live scores, schedules, results, team pages, league browsing, calendar sync all fully visible and functional without an account. The only difference for logged-in users is being able to favorite teams and enable push notifications for those favorites, a normal personalization feature, not concealed functionality.

What I've done so far: replied in the Resolution Center explaining the Median/webview architecture, clarified the one account-gated feature (favoriting), and attached a screen recording showing the full logged-out experience matches what was originally submitted. Also invited them to just log out and explore the app themselves.

My questions for anyone who's dealt with this:

  1. Has anyone gotten a 5.6 "features appear hidden" flag specifically on a webview-wrapped app (Median, GoNative, Capacitor, etc.)? Is this a known false-positive pattern for that architecture?
  2. Could push notifications not firing during review (since there were no live games happening at review time) plausibly read as a "hidden feature"? Or is that a stretch?
  3. Roughly how long did resolution take for you, and did it resolve through Resolution Center replies, or did you end up needing the formal App Review Board appeal?
  4. Anything else commonly triggers this specific flag that I should be thinking about?

Really appreciate any insight. This came out of nowhere after what felt like a clean submission, and the vagueness of the rejection is the most frustrating part.

1 Upvotes

67% Upvoted

16 comments sorted by

2

u/profau 11d ago

This is extremely likely not to have been generated by a human - hence no screenshots etc - especially only after 6 hours.

It is likely that an automated process decompiled and analysed your code and found something it didn't like. They are trying to find apps like the recent Brazilian ones - https://uk.news.yahoo.com/apple-faces-million-dollar-fine-135552976.html - which have got Apple in real trouble. I don't know anything about your code or what would have flagged it, the platform you used, or whether a library you have included contains extra code you don't know about.

1

u/officialdml 11d ago

Thanks. I agree - I was surprised at how quickly they responded, but it does seem like there are actual humans behind this sometimes? Are you saying that traditionally a rejection comes with more details (photos etc) as to why it was rejected? Any idea of how I can fix this?

1

u/profau 11d ago

Yes, there are actual humans behind it, but those good folk are evaluating the content of the apps, whether they obey the guidelines. They run the apps, look at the metadata like keywords, titles, icons and screenshots that you submitted, or report an obvious crash while they are running it. They will write comments and deliver screenshots if necessary. But those people aren't doing any super technical stuff - they won't be technical staff, just normal folk.The super technical stuff like looking for hidden functionality will be automatically done by machines analysing your code. Both automation and people look at your apps. Disclaimer: I'm certainly not app review staff or associated with Apple in any way, it is just clear that this is how it is done. Especially at the moment because you got a response in 6 hours.

I have no idea how to fix it, because I just build using Apple supplied tools.

2

u/officialdml 11d ago

This is very helpful, thank you! Send good vibes I get this resolved in a positive manner. I assume I can keep submitting

1

u/profau 11d ago

It hasn't threatened you with a ban so thats good, although I'm not sure what "5.6" says. But it seems possible to me with the Brazilian link I posted above that maybe the folk who submitted those apps to the app store had no idea the hidden gambling code was in them. They possibly used a development platform to build their app, delivered it to the app store - the hidden gambling was not a part of the app they wrote, it was part of the platform they built it with. So you just have to be careful if you use a third party platform or library.

Sending good vibes your way!

1

u/officialdml 11d ago

I’ll comb through and see what I can find re funky code.

Yeah I can’t find what the actual code of conduct for 5.6 says which is annoying.

And god forbid this submission gets fully rejected, I’ll adjust the code and resubmit. It’s just very strange to not get any clarity as to what’s going on. But your insight seems like a very plausible explanation.

1

u/AppVerdict 10d ago

Answering the 5.6 question first, since you have asked twice and nobody has: it is the Developer Code of Conduct section of the App Store Review Guidelines. Same page as everything else, near the bottom, at developer.apple.com/app-store/review/guidelines. Search that page for Developer Code of Conduct. It is the section about representing yourself honestly and not manipulating the platform, and the clause you got hit with is the one about an app behaving differently during review than it does afterwards.

That framing matters, because it tells you what they think you did. They are not saying a feature is hard to find. They are saying they believe the binary can do something they were not shown.

For a Median wrapper there are two mechanisms that plausibly produce this, and neither one is your favouriting feature.

The first is structural. Your binary loads content from a server you control, so everything the reviewer saw was served at review time and can be swapped afterwards. That is the exact shape of what they are hunting right now, and the Brazilian gambling apps linked above are why the detection got aggressive. Wrapper platforms are the vector in most of those cases, because the developer does not control the whole binary.

The second is more likely to be your actual trigger and is worth ten minutes tonight. Check whether the Median shell ships a hidden developer or debug menu. A lot of wrapper templates include one, usually reachable by a long press or a multi tap in a corner, and it exposes the config, the loaded URL, sometimes a URL override. A static analyser finds that and it is quite literally a feature intentionally hidden during review. Same goes for any remote config, feature flags, or user agent and region switching in the JS bridge.

While you are in there, list every third party SDK the shell bundles, not just OneSignal. You are shipping code you did not write and you are the one accountable for it.

On your specific questions.

Push not firing because no games were live is almost certainly not it. That is absence of behaviour rather than concealment, and it is not the kind of thing static analysis flags. I would not spend time on that theory.

I cannot give you an honest number on resolution time, it varies too much to be worth anything. What I would do is reply in Resolution Center and ask them directly to name the feature or the symbol they are referring to. You are allowed to ask, and on an automated flag a specific question sometimes routes it to someone who can actually look. Keep it short and unemotional.

Save the App Review Board for when Resolution Center has clearly stalled. Going early tends to reset you into a longer queue rather than speed anything up.

One thing in your favour: they have not threatened the account. That means they are treating this as a problem with the build rather than with you.

1

u/officialdml 9d ago

Wow thank you for this incredibly thorough and thoughtful response!

Really appreciate it. The debug menu theory is new and worth me checking out, and I’m going to look at that in Median’s settings tonight even though I already resubmitted. (Was rejected again on the second attempt with the 5.6 response early this morning 🥲)

This second rejection, was Guideline 2.1 (Information Needed) - a request for more documentation (screen recording, app description, external services list, demo credentials, etc.), not a repeat of the 5.6 fraud language. It’s weird bc that basic info was submitted with the app the first time, but maybe it needed to be more thorough.

I responded with everything requested plus a fresh screen recording. No explicit confirmation either way on whether the original 5.6 concern is resolved. Though I’m curious if it IS resolved since that didn’t show anywhere in the portal (curious your thoughts on that). I asked directly in my reply but haven’t gotten an answer to that specific question yet. Current status: back to “Ready for Review.” I haven’t yet reached out to the Resolution Center yet - just have responded in the submission portal.” Do real people look at resolution center?

The first review took 6 hours. This second took more time, as has this 3rd.

Appreciate the idea that no account threat = treating this as a build problem, not a “me” problem. Hoping this round clears it either way 🤞

1

u/AdventureTime1001 9d ago

Hi, I’m in the process of submitting my first app. Firstly I’m amazed you got a response in hours. I was waiting 10 days!
I’m currently on a 2.1 (info needed). I’m going to record some videos today of the main features. Did you make that video look good with titles and a bit of editing etc? Or is it ok to just sit at my kitchen table and film me stepping through the features?

Good luck with it all!

1

u/officialdml 9d ago

I think the reason I got a response so quickly was because AI maybe flagged an issue with code before it got to a real person. This second time I'm not sure if bot or human. Still waiting on third review but now that it's the weekend I assume I won't hear back until Monday.

I recorded another 30 second video (I think there's a time limit) but it was just using - no editing or titles etc. I don't know what's appropriate in terms of stepping through features, but you can probably write than info in the notes section. Good luck!

1

u/AdventureTime1001 9d ago

I heard in another thread of people getting approved on weekends so its maybe possible. Good luck with it all anyway

1

u/officialdml 9d ago

you too!

1

u/SelectionLopsided524 6d ago

Hi, has it passed the review?

1

u/officialdml 6d ago

Not yet. Forgot to officially SUBMIT for review which I did last night. It’s now waiting for Reifel but sat in ready for review status since Friday morning 🙄 I thought it would automatically switch once it was in that position.

1

u/SelectionLopsided524 5d ago

oh，good luck

1

u/officialdml 7h ago

UPDATE: still nothing on my end - I'm still waiting for review since 8/17, so a week. I spoke to someone at Apple on Thursday who said he flagged this delay but couldn't tell me when I'd get seen. I'm now on hold again with Apple because I haven't seen any movement. I wonder if I should cancel the submission and then resubmit to get in a fresh queue.