Claude Code, Skill
App Store Review Playbook
End-to-end guide for building and shipping a mobile app to the App Store and Google Play, written from real rejections and real build failures.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
references/02-testflight-ios.md, line 80
Watch and Live Activity widgets need their own provisioning profiles in `credentials.json`, all under the same distribution certificate. Archiving a Watch target requires the watch
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md, line 63
- **Crashes that only exist in standalone builds** - a gitignored `.env` that never reached the archive and crashed *every* build, a dynamically imported native module invisible in
references/01-prototype.md, line 39
```
references/02-testflight-ios.md, line 80
Watch and Live Activity widgets need their own provisioning profiles in `credentials.json`, all under the same distribution certificate. Archiving a Watch target requires the watch
Show more
references/01-prototype.md, line 44
**An ignored `.env` never reaches the EAS archive.** The bundle ships with empty variables and the app crashes on launch - in standalone builds only, so the simulator and dev clien
references/05-rejections.md, line 154
- If `.env` is gitignored it never reaches the EAS archive → empty variables in the bundle → crash on launch. In one app *every* build crashed for this reason.
references/06-stack.md, line 100
- **Keep `.env` out of `.gitignore` reasoning for EAS.** An ignored `.env` never reaches the EAS archive, producing empty variables and a launch crash that only appears in standalo
references/06-stack.md, line 122
| 2.1 App Completeness, "app crashed on launch" | `.env` never reached the build |
references/de/01-prototyp.md, line 39
```
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 875146e9c0c2. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 875146e9c0c2307f9fa7a812dc51e02960b3b659
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.