data-minimization-audit

Run this audit on your project root to scan Swift and Objective-C files for over-broad permission requests. It flags full photo library access, full contacts access, and always-on location usage, then reports each finding with file path, line number, and the privacy-preserving API to use instead.

PHPickerViewController is the recommended alternative for photo selection use cases. It lets users pick images without requiring NSPhotoLibraryUsageDescription or full library authorization, which is exactly the pattern Apple reviewers look for under Guideline 5.1.1(iii).

Yes, the audit supports Swift, Objective-C, React Native, and Flutter projects. It scans .swift and .m source files, entitlements files, and PrivacyInfo.xcprivacy manifests using glob and grep patterns.

Requesting always-on location without the com.apple.location.always entitlement and a strong use-case justification violates data minimization rules. The audit checks your entitlements files and flags missing declarations as high-severity findings, recommending requestWhenInUseAuthorization where appropriate.

The audit is read-only and performs static pattern matching, so it cannot verify runtime behavior or judge whether a permission request is genuinely justified by app functionality. It also makes no network calls and does not modify any files.