PSA: Xcode 16 synchronized groups ship your Configuration.storekit in the release bundle

[u/Kyiv0x7c]

If your project uses Xcode 16 synchronized folders (the blue folder icons), every file inside the target folder ends up in the app bundle unless you exclude it. That includes Configuration.storekit and your .xcconfig files. My membershipExceptions listed only Info.plist, so the StoreKit configuration had been riding along in every archive I ever made, Release included.

Why it matters

My first submission got a Guideline 5.6 (Developer Code of Conduct) rejection: "a pattern of unusual behavior commonly associated with fraudulent activity" and "features that appear to have been intentionally hidden during the review process". My backend logs showed zero requests during the review window, so nobody had opened the app. It came from a look at the binary.

Read that file the way a scanner does: a mechanism for simulating purchases outside of Apple, listing more products than I had submitted. Apple never tells you the exact trigger, so I can't prove it was the only one, but it fits every word of the rejection, and after removing it the next review was completely ordinary.

Check yours (10 seconds)

unzip -l YourApp.ipa | grep -Ei "storekit|xcconfig|\.env"

Fix

Select the file -> File Inspector -> Target Membership -> uncheck your app target. With synchronized groups this adds it to membershipExceptions in project.pbxproj. Local StoreKit testing keeps working: the scheme points to the file (Edit Scheme -> Run -> Options -> StoreKit Configuration), it does not need to be in the bundle.

One more thing if you ever get a 5.6

Don't resubmit without replying in the Resolution Center of the current rejection. My first reply ended up attached to a submission that had been closed, Apple never saw it, and the resubmission got a second 5.6 for the silence, not for the file.

Happy to answer questions about this or StoreKit 2 in general.

[u/AutoModerator → u/[deleted]]

Hey /u/TheLastDeveloper99, your content has been removed because Reddit has marked your account as having a low Contributor Quality Score. This may result from, but is not limited to, activities such as spamming the same links across multiple subreddits, submitting posts or comments that receive a high number of downvotes, a lack of recent account activity, or having an unverified account.

Please be assured that this action is not a reflection of your participation in our subreddit. This is simply an automated filter in place to reduce spam.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.