push-notification-audit

Run this audit against your project root. It greps for requestAuthorization calls in AppDelegate or SceneDelegate, scans notification payload strings for marketing keywords, and verifies delegate implementation and entitlements, then reports findings by severity.

Apple treats requesting push permission in application(_:didFinishLaunchingWithOptions:) before any user interaction as permission abuse under Guideline 4.5.4. Move the requestAuthorization call to a contextual moment, such as when the user enables a notification-driven feature.

Only with a separate explicit opt-in for promotional notifications — general push permission does not cover marketing use cases. Push notifications may never carry advertising content such as sponsored messages or interstitial ads.

Yes. It works on Swift and Objective-C projects, and React Native or Flutter push implementations use different class names but the same payload patterns apply, so the marketing keyword and payload checks still detect violations.

Push notifications will silently fail at review time if the entitlements file lacks aps-environment. The audit flags this as a HIGH severity finding when requestAuthorization is used without the entitlement present.