App Store Review Guideline Changes (Oct 16, 2026): Check Your App with Claude Code Before You Submit

Key takeaways

• On October 16, 2026, Apple updated the App Review Guidelines. The changed sections: 1.2, 2.3.14, 2.5.19, 3.1.1(a), and 5.
• 2.5.19: no hidden, dormant, or undocumented features. Trying to hide them, for example with code obfuscation, is grounds for removing your app and terminating your developer account. The rule isn't new; it used to live under 2.3.1. Now it's its own guideline.
• 1.2: apps where users can share content, or generate content with AI, need filtering, reporting, blocking, and contact info. Skipping these, or not fixing violations after Apple flags them, can count as a Developer Code of Conduct violation.
• An old rule people forget (2.3.1(a)): describe every new feature clearly in the Notes for Review field in App Store Connect. Generic descriptions get rejected.
• Below: a plain summary of the rules, a Claude Code prompt that scans your app before you submit, a fill-in Notes for Review template, and a 4-item checklist for apps with user content.

What this page is

This is the page behind the reel. Comment REVIEW and you land here: a plain summary of the new rules, a Claude Code prompt that scans your app before you send it to Apple, a Notes for Review template, and a user-content checklist.

Everything here comes from Apple's October 16 announcement, its second announcement the same day, and the App Review Guidelines, all checked on October 18, 2026. If something here disagrees with Apple's pages, trust Apple's pages.

What changed on October 16

Apple also added documentation links to the "Before You Submit" and "After You Submit" sections. Translations will be on the Apple Developer site within one month.

2.5.19: No hidden features

The rule: "Don't include any hidden, dormant, or undocumented features in your app; your app's functionality should be clear to end users and App Review." Trying to hide undocumented features in your binary, such as through code obfuscation, is grounds for removal from the App Store and termination of your developer account.

Apple's second announcement spells out what it's aimed at: apps that show one thing during review and change after approval, for example by adding features that weren't in the submitted version. Apps found doing this can be removed from the App Store and the Apple Developer Program.

One event to put next to it: in a July 2026 investigation, 9to5Mac reported finding dozens of App Store apps that looked like simple games and utilities but turned into hidden betting platforms when opened from a Brazilian IP address. Apple doesn't tie this rule change to that report. But it shows exactly what 2.5.19 rules out.

1.2: Four safeguards for user content

The rule covers apps where users create, generate, upload, share, or otherwise contribute content. It names social media, user-generated content platforms, and AI content creation apps. These apps must include:

1. A method for filtering objectionable material before it's posted
2. A way to report offensive content, and timely responses to reports
3. The ability to block abusive users
4. Published contact information so users can easily reach you

What's new: the rule now names nonconsensual intimate imagery, including AI-generated imagery. And not implementing these safeguards, or not fixing violations after notice, may count as a Developer Code of Conduct violation. Egregious or repeated behavior is grounds for immediate removal from the App Store and from the Apple Developer Program.

2.3.14: Creative assets

Creative assets are a new kind of App Store promo image. Unlike screenshots, they can show up in the product page header and in search results. They must relate to your app or brand and be appropriate for all audiences. They can't include inappropriate content, references to other apps meant to mislead, unverifiable product claims (like "the #1 app"), or specific or discounted pricing.

3.1.1(a): External purchase links

This covers apps that use a special Apple entitlement, in certain regions, to link users to a payment page outside the app. The separate Music Streaming Services bullet now lives inside this one, and Apple clarified that the link may go to a permitted destination; permitted destinations vary by region. If you don't use these entitlements, the old rule still applies: outside the US storefront, no buttons or links that send users to a payment method other than in-app purchase.

5: Human trafficking and child exploitation

Apps found to facilitate human trafficking or the exploitation of children are removed from the App Store, blocked from alternative distribution, and reported to the appropriate authorities.

Why this matters if you vibe code

Apple doesn't use the words "vibe coding"; the rules apply to everyone. But if AI writes most of your app, these rules are easier to trip over:

• Forgotten screens. The AI may have written a test screen, a debug menu, or a "coming soon" page. Even if nothing in the UI reaches it, it's in the code.
• Feature flags. "Get approved first, turn the feature on later" is exactly what 2.5.19 rules out.
• Features you didn't notice. The AI may have added something you didn't ask for or didn't spot. Any feature you don't describe in Notes for Review counts as undocumented.
• AI features. If your app generates images or text with AI, you're now explicitly covered by 1.2.

These are hard to find by hand. Claude Code can scan the whole codebase.

Before you submit: a Claude Code prompt

Open your app's code in Claude Code and paste this prompt. Put your App Store description and this version's release notes in the brackets. It works for Expo, React Native, Swift, or Flutter.

Before I submit this project to the App Store, scan it against Apple's App Review Guidelines. Don't change any files; only write a report.

My App Store description and this version's release notes:
[Paste your App Store description and "What's New" text here]

1. Hidden or dormant features (guideline 2.5.19):
   - Screens, pages, and routes that nothing in the UI leads to
   - Developer menus, debug screens, secret gestures (like tapping the logo 5 times), secret codes
   - Anything turned on or off by feature flags or remote config (Firebase Remote Config, PostHog, Statsig, LaunchDarkly, GrowthBook, ConfigCat, or our own system). For each flag: what it turns on, its current value, and whether it's on during review
   - Code that behaves differently by country, language, IP, time zone, date, or for specific users
   - Code that opens new screens or features based on a server response, and WebViews that load remote URLs
   - Anything that downloads or runs code remotely (eval, remote JS bundles, OTA updates like expo-updates or CodePush)
   - Every feature that isn't mentioned in the store description or release notes

2. User content (guideline 1.2): Can users share text, images, video, comments, profiles, or messages, or generate content with AI? If so, show the file and line for each of these, or say it's missing:
   - A filter that catches objectionable content before it's posted
   - A way to report content, and a place where reports reach us
   - Blocking users
   - Contact information visible in the app
   If the app generates images with AI, is there a safeguard that stops it from generating nonconsensual intimate images of real people?

3. Review access (guideline 2.1): Does the app need sign-in, so a demo account is needed? Are in-app purchases visible and working? Is there leftover placeholder text, an empty page, a localhost address, or a test server URL?

4. External payment links (guideline 3.1.1): Is there a button or link that sends users to pay on the web instead of using in-app purchase?

Format the report like this:
- For each finding: file and line, what it is, the Apple guideline, risk (high / medium / low), and your suggested fix
- At the end, a "Notes for Review" draft filled in from what you found

Don't flag something as a hidden feature unless you're sure; list uncertain items separately under "Check this". After the report, I'll tell you which fixes to make.

When you get the report, start with the high-risk findings. If a hidden screen really isn't used, delete it. If it is, make it reachable from the UI and describe it in Notes for Review.

The prompt scans your code, not your server. Check the values in your remote config dashboard (which flags are on right now) yourself.

Notes for Review template

Notes for Review is the field in App Store Connect that only Apple's review team sees. Guideline 2.3.1(a) says every new feature, functionality, and product change must be described "with specificity" there, and "generic descriptions will be rejected."

Fill in the brackets and delete the sections that don't apply:

WHAT'S NEW IN THIS VERSION
1. [Feature name]: [What it does, in one sentence]. How to reach it: [Tab] > [Screen] > [Button].
2. [Feature name]: [What it does]. How to reach it: [path].

SIGN-IN
A demo account is in the Sign-In Information section. It has [an active Pro subscription / admin access] so you can test every feature, including [feature].

IN-APP PURCHASES
[Product name] is shown on [screen]. [If a product can't be found in the app, explain why.]

USER-GENERATED CONTENT
Users can [post comments / upload photos / create profiles / generate images with AI].
- Filtering: [How objectionable content is filtered before it's posted.]
- Reporting: [Where the Report button is.] Reports go to [our moderation inbox] and we respond within [24 hours].
- Blocking: [Where the Block button is.]
- Contact: [Where our contact information is shown in the app.]

AI FEATURES
[What the AI feature does, and the safeguards that stop it from producing objectionable content, including intimate images of real people.]

FEATURE FLAGS AND REMOTE CONFIGURATION
[The app doesn't use feature flags or remote configuration.]
or
[We use (tool) for (purpose). Every feature in this build is turned on for review. We don't use remote configuration to turn on features that weren't reviewed.]

SPECIAL REQUIREMENTS
[Hardware, location, a sample QR code, a test card, or "None".]

Don't put the demo account password in the notes. App Store Connect has a separate Sign-In Information section for it. Under guideline 2.1, any app with a login needs a demo account, and your backend must be live during review.

A note that gets rejected:

Bug fixes and new features.

A note that works:

1. Saved searches: users can save a search and get a notification when new results appear. How to reach it: Search tab > run any search > "Save" (top right). Notifications need push permission.
2. Dark mode: follows the system setting. Can be changed in Settings > Appearance.

4-item checklist for apps with user content

If users can share anything other people see, or generate content with AI, test all four yourself before you submit:

1. Filter. Objectionable content is caught before it's posted: a profanity filter, automatic image checks, or approval before publishing. If you generate images with AI, safeguards that block intimate images of real people. Test: try posting a comment with a banned word.
2. Report. Every post and every profile has a "Report" option, reports reach you, and you respond in time. Test: report a post and confirm the report arrives.
3. Block. A user can block another user, and the blocked person's content disappears. Test: block from a second account and check the content is gone.
4. Contact info. An email address or support page that's easy to find inside the app. Test: can you reach it in two taps from Settings or the profile screen?

Describe all four in the "User-Generated Content" section of Notes for Review, with where each one is. Don't make the reviewer hunt for them.

FAQ

Are feature flags banned?

Apple doesn't use the words "feature flag." 2.5.19 says your app's functionality should be clear to users and to App Review. My reading: gradually rolling out a feature that was reviewed is a different thing. Using a flag to turn on a feature the reviewer never saw, after approval, is exactly what the rule bans. If you use flags, say so in Notes for Review and keep every feature on during review.

Can I still ship updates with Expo Updates or CodePush?

Guideline 2.5.2 says an app may not download or run code that introduces or changes features or functionality. Use OTA updates for bug fixes. Ship new features as a new App Store version, and describe them in Notes for Review.

My app generates images with AI, but nothing is shared. Does 1.2 apply?

The rule names AI content creation apps directly and expects you to prevent nonconsensual intimate imagery, including AI-generated imagery. Assume you're covered, and at least put a filter on the generation side.

When will translated guidelines be out?

Apple says translations of the updated guidelines will be on the Apple Developer site within one month.

What if my app gets rejected?

The rejection message names the guideline. Fix the problem, reply in App Store Connect, and resubmit. If you think the decision is wrong, you can appeal to the App Review Board.

Try it

Before your next submission, run the prompt, fix the high-risk findings, and fill in Notes for Review with the template. If you have user content, test the four items yourself.

Before you launch, also make sure there's no API key left in your client code: vibe coding security checklist. Building with Expo? From create-expo-app to App Store covers what's still missing before you ship.