Content rights — images, fonts, music, and trademarks are licensed
Why it matters
Using unlicensed content — a commercially-licensed font TTF file distributed without a mobile app license, a stock photo with a watermark removed, background music without a synchronization license — violates copyright law (17 U.S.C. §501) and supply chain integrity (CWE-1357). App stores reject apps containing clearly infringing assets when detected during review, and rights holders can file DMCA takedowns post-publication that force removal within 24 hours. Commercial font licenses for desktop typically explicitly exclude app distribution; Proxima Nova, Gotham, and Helvetica Neue each require separate mobile licensing agreements costing hundreds to thousands of dollars annually.
Severity rationale
High because unlicensed assets expose the developer to copyright infringement claims, DMCA takedowns, and forced app removal — each of which disrupts active users.
Remediation
Audit every asset in assets/, src/assets/, and lib/assets/ before submission. Create a THIRD_PARTY_LICENSES.md at the repo root documenting each third-party asset:
# Find all font files in the project
find . -name '*.ttf' -o -name '*.otf' | sort
# Find all audio files
find . -name '*.mp3' -o -name '*.wav' -o -name '*.m4a' | sort
Replace commercial fonts with open-licensed equivalents: Google Fonts packages (@expo-google-fonts/*) use the Open Font License and are safe for app distribution. Replace stock photos with CC0-licensed images from Unsplash or Pexels (verify each image's specific license for commercial use). For icon libraries, use FontAwesome Free (SIL OFL + MIT) or Material Icons (Apache 2.0) rather than Pro icon sets without documented licenses.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Metadata & Listing Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1357 — Reliance on Insufficiently Trustworthy Component
- spdx · spdx-license-list — SPDX License List — reference for open-source asset license classification
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-metadata-listing·automated