private-api-audit

Run this audit on your project root to grep Swift and Objective-C sources for dlopen, NSClassFromString with private class names, underscore-prefixed selectors, and private framework imports. Findings are reported with file paths, line numbers, and severity tiers mapped to Guideline 2.5.1.

ITMS-90338 is triggered by Apple's automated binary analysis detecting dlopen or dlsym calls, symbol references to non-public frameworks, or underscore-prefixed private methods. The scanner runs at upload, so an app can pass human review and still be rejected by the binary scan.

Yes, it greps for method_exchangeImplementations, class_replaceMethod, method_setImplementation, and swizzle patterns. Matches targeting system classes like UIViewController or UIApplication are flagged as HIGH severity since swizzling Apple classes is fragile and may be flagged as private API abuse.

Yes, third-party SDKs can introduce private API usage into your binary. The audit recommends checking dependency frameworks and running otool -L on the final binary to list all linked libraries, plus nm on the release binary to check for private symbol references.

No, only when the string argument references private Apple classes with prefixes like _UI, _NS, or _CA, such as _UIBackdropView. The audit reads surrounding context for each NSClassFromString match to determine whether the target class is private.