No remote configuration that enables policy-violating behavior post-approval

Apple's guideline 2.5.2 prohibits downloading and executing code after approval. Remote configuration that can enable gambling mechanics, cryptocurrency payments, adult content, or affiliate link injection after a binary passes review is treated as deliberate deception — the consequence is not just rejection but developer account termination, which affects every app in the account. The pattern is detectable: reviewers who see LaunchDarkly or Statsig in a binary will check what flags control and whether any could enable policy-violating behavior. Dynamic code construction from remote strings — eval-equivalent patterns — is a hard rejection regardless of what the code does.

Audit every remote config flag before submission. List each flag and what it gates — any flag controlling a feature category that wasn't present at review time is a risk.

// scripts/audit-feature-flags.ts
// Run before every App Store submission
const HIGH_RISK_FLAG_PATTERNS = [
  /crypto|payment|gambling|adult|affiliate|porn/i,
];

const flags = await launchDarkly.getAllFlags();
for (const [key] of Object.entries(flags)) {
  if (HIGH_RISK_FLAG_PATTERNS.some(p => p.test(key))) {
    console.error(`HIGH RISK FLAG: ${key} — verify feature was present at last review`);
  }
}

For any flag that could enable a new payment flow or major feature: disable it and submit a new app version with that feature already built in and visible to reviewers. Remove all patterns that construct logic from remote-fetched strings at runtime.