Profanity or objectionable content filter on user input

Apple's guideline 1.2 requires apps accepting user-generated text to filter objectionable content before it is stored and shown to others. Storing post or comment text directly to the database with no filtering (CWE-20, OWASP input validation) means a reviewer can post profanity or offensive content in your app and immediately see it appear — a scenario that results in rejection. Client-side filtering alone is insufficient because it is trivially bypassed via direct API calls. The combination of server-side filtering and the reporting mechanism (ab-000498) is the minimum acceptable moderation stack for any UGC platform.

Add server-side content filtering to every UGC submission route before writing to the database.

// src/app/api/posts/route.ts
import Filter from 'bad-words';
const filter = new Filter();

export async function POST(req: Request) {
  const { text } = await req.json();
  if (filter.isProfane(text)) {
    return Response.json({ error: 'Content violates community guidelines' }, { status: 400 });
  }
  // proceed to store
}

For image content, integrate AWS Rekognition or Google Vision Safe Search. For higher-volume text needs, the OpenAI Moderation API is free and covers hate speech, self-harm, and sexual content categories that bad-words misses. Client-side filtering is a UX nicety, not a substitute for server-side enforcement.