# No remote configuration that enables policy-violating behavior post-approval

- **Pattern:** `ab-000510` (`app-store-review-blockers.technical-requirements.no-hidden-features`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000510
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000510)

## Why it matters

Apple's guideline 2.5.2 prohibits downloading and executing code after approval. Remote configuration that can enable gambling mechanics, cryptocurrency payments, adult content, or affiliate link injection after a binary passes review is treated as deliberate deception — the consequence is not just rejection but developer account termination, which affects every app in the account. The pattern is detectable: reviewers who see LaunchDarkly or Statsig in a binary will check what flags control and whether any could enable policy-violating behavior. Dynamic code construction from remote strings — eval-equivalent patterns — is a hard rejection regardless of what the code does.

## Severity rationale

High because enabling policy-violating features via remote config post-approval is treated by Apple as deception, with account termination (not just app removal) as the consequence.

## Remediation

Audit every remote config flag before submission. List each flag and what it gates — any flag controlling a feature category that wasn't present at review time is a risk.

```ts
// scripts/audit-feature-flags.ts
// Run before every App Store submission
const HIGH_RISK_FLAG_PATTERNS = [
  /crypto|payment|gambling|adult|affiliate|porn/i,
];

const flags = await launchDarkly.getAllFlags();
for (const [key] of Object.entries(flags)) {
  if (HIGH_RISK_FLAG_PATTERNS.some(p => p.test(key))) {
    console.error(`HIGH RISK FLAG: ${key} — verify feature was present at last review`);
  }
}
```

For any flag that could enable a new payment flow or major feature: disable it and submit a new app version with that feature already built in and visible to reviewers. Remove all patterns that construct logic from remote-fetched strings at runtime.

## Detection

- **ID:** `no-hidden-features`
- **Severity:** `high`
- **What to look for:** Count all relevant instances and enumerate each. Search for remote configuration usage: `firebase/remote-config`, `LaunchDarkly`, `Statsig`, `GrowthBook`, `expo-constants` with server-fetched overrides, or any `fetch('/api/config')` call that returns feature flags applied at runtime. Look for feature flags that gate: payment flows, gambling mechanics, adult content, cryptocurrency features, affiliate linking, or any feature that would require App Store review if submitted initially. Also look for dynamic code execution patterns — runtime construction of executable logic from strings, dynamic `require()` calls loading from remote URLs, or script tags injected into WebViews from remote sources. Check for URL scheme handlers or deep links that could trigger hidden functionality.
- **Pass criteria:** Remote configuration, if present, only controls: UI theming, A/B test copy variants, feature rollout percentages for already-reviewed features, or non-functional toggles. At least 1 implementation must be verified. No remote config key can enable a feature category that was not present and reviewable at submission time.
- **Fail criteria:** Remote config can enable: adult content, gambling, cryptocurrency payments, affiliate link injection, or any feature that would be rejected if submitted for review. Dynamic code execution from remote strings present.
- **Skip (N/A) when:** Never.
- **Detail on fail:** `"LaunchDarkly flag 'enable_crypto_payments' found — this could enable a feature requiring re-review post-approval"` or `"App constructs and runs code dynamically from remotely-fetched configuration strings"`
- **Remediation:** Apple guideline 2.5.2 prohibits apps from downloading executable code after approval. Using remote config to enable policy-violating features results in account termination.
  1. Audit all remote config keys — list every flag and what it enables
  2. For any flag that could enable a new major feature, ensure that feature is already present and reviewable at submission time
  3. Remove any patterns that construct executable logic from remote strings at runtime
  4. Submit a new app version (with review) when enabling substantially new features, even if technically possible via remote config


  Review the configuration in `src/` or `app/` directory for implementation patterns.

- **Cross-reference:** For related patterns and deeper analysis, see the corresponding checks in other AuditBuffet audits covering this domain.

---

## External references

- external apple-guideline-2.5.2-hidden-features — https://developer.apple.com/app-store/review/guidelines/#software-requirements

Taxons: regulatory-conformance

HTML version: https://auditbuffet.com/patterns/ab-000510