What is iOS 'app review' and why does it complement the technical sandbox from a security perspective?
- A.App review is carried out by the iOS device itself at install time, and the platform inspects every binary against Apple's published policy list before it maps the first page, refusing anything that declares an entitlement the provisioning profile does not carry, all of it happening offline on the handset
- B.Apple's manual and automated app review process checks that apps accurately describe their data usage, request only necessary permissions, and do not use private APIs or misleading entitlement claims, complementing the technical sandbox by catching policy violations before distribution
- C.App review is a developer self-certification exercise with no security value at all, and Apple accepts each submitted questionnaire without inspecting the binary behind it, leaving the technical sandbox as the whole of the protection a user has, and every policy claim in the listing goes unverified
- D.App review checks an app against the design guidelines alone, and nothing in the process touches security, leaving a private API call to pass as readily as a public one