Apple's guideline 1.2 requires apps accepting user-generated text to filter objectionable content before it is stored and shown to others. Storing post or comment text directly to the database with no filtering (CWE-20, OWASP input validation) means a reviewer can post profanity or offensive content in your app and immediately see it appear — a scenario that results in rejection. Client-side filtering alone is insufficient because it is trivially bypassed via direct API calls. The combination of server-side filtering and the reporting mechanism (ab-000498) is the minimum acceptable moderation stack for any UGC platform.
Medium because unfiltered UGC submission directly violates Apple guideline 1.2 and any reviewer can verify the failure in seconds by typing into a post field.
Add server-side content filtering to every UGC submission route before writing to the database.
// src/app/api/posts/route.ts
import Filter from 'bad-words';
const filter = new Filter();
export async function POST(req: Request) {
const { text } = await req.json();
if (filter.isProfane(text)) {
return Response.json({ error: 'Content violates community guidelines' }, { status: 400 });
}
// proceed to store
}
For image content, integrate AWS Rekognition or Google Vision Safe Search. For higher-volume text needs, the OpenAI Moderation API is free and covers hate speech, self-harm, and sexual content categories that bad-words misses. Client-side filtering is a UX nicety, not a substitute for server-side enforcement.
app-store-review-blockers.content-moderation.objectionable-content-filtermediumbad-words, profanity-filter, leo-profanity, or custom filter implementations with word lists. Look for API-side filtering in server routes that accept UGC (search for filter, sanitize, moderate, check calls before storing text). Check if text input components have maxLength limits. Look for third-party moderation API calls at post/submit time (OpenAI Moderation API, Google Perspective API, Hive Moderation)."Post submission in src/api/posts.ts stores text directly to database with no content filtering"import Filter from 'bad-words';
const filter = new Filter();
if (filter.isProfane(postText)) {
return res.status(400).json({ error: 'Content violates community guidelines' });
}