Find the Code That Trips App Store 2.5.2 Before You Submit

The preflight script

This is the script I actually ran, verified on Node.js 22. No dependencies.

#!/usr/bin/env node
// scan-2-5-2.mjs — surface paths that can change app behavior after review
// usage: node scan-2-5-2.mjs src app
import { readdirSync, readFileSync, statSync } from "node:fs";
import { join, extname } from "node:path";
 
const TARGET_EXT = new Set([".js", ".jsx", ".ts", ".tsx"]);
const SKIP_DIR = new Set(["node_modules", ".git", "ios", "android", "dist", "build"]);
 
// severity: block = remove before submitting / review = keep if you can justify the input
const RULES = [
  { id: "eval-call",         severity: "block",  re: /(^|[^.\w])eval\s*\(/,
    hint: "A string is being executed as code" },
  { id: "function-ctor",     severity: "block",  re: /new\s+Function\s*\(/,
    hint: "The Function constructor is treated the same as eval" },
  { id: "remote-import",     severity: "block",  re: /import\s*\(\s*[`'"]https?:\/\//,
    hint: "A remote module is loaded at runtime" },
  { id: "webview-inject",    severity: "review", re: /injectedJavaScript(BeforeContentLoaded)?\s*[=:]/,
    hint: "Check where this injected JS comes from" },
  { id: "webview-html",      severity: "review", re: /source\s*=\s*\{\{\s*html\s*:/,
    hint: "Check whether arbitrary HTML can reach this" },
  { id: "remote-screen-map", severity: "review", re: /components?\s*\[\s*(remote|payload|res(ponse)?|json)\w*\./i,
    hint: "A remote value selects which implementation runs" },
];
 
function walk(dir, out = []) {
  for (const name of readdirSync(dir)) {
    if (SKIP_DIR.has(name)) continue;
    const p = join(dir, name);
    if (statSync(p).isDirectory()) walk(p, out);
    else if (TARGET_EXT.has(extname(p))) out.push(p);
  }
  return out;
}
 
// Only skip lines that start with // or *. Over-reporting beats missing something
const isComment = (line) => /^\s*(\/\/|\*|\/\*)/.test(line);
 
const roots = process.argv.slice(2);
if (roots.length === 0) {
  console.error("usage: node scan-2-5-2.mjs <dir> [dir...]");
  process.exit(2);
}
 
const findings = [];
let scanned = 0;
 
for (const root of roots) {
  for (const file of walk(root)) {
    scanned++;
    const lines = readFileSync(file, "utf8").split("\n");
    lines.forEach((line, i) => {
      if (isComment(line)) return;
      for (const rule of RULES) {
        if (rule.re.test(line)) {
          findings.push({ file, line: i + 1, ...rule, text: line.trim().slice(0, 100) });
        }
      }
    });
  }
}
 
const blocks = findings.filter((f) => f.severity === "block");
const reviews = findings.filter((f) => f.severity === "review");
 
for (const f of findings) {
  const mark = f.severity === "block" ? "BLOCK " : "REVIEW";
  console.log(`${mark} ${f.file}:${f.line}  [${f.id}] ${f.hint}`);
  console.log(`        ${f.text}`);
}
 
console.log(`\nscanned ${scanned} files / block ${blocks.length} / review ${reviews.length}`);
process.exit(blocks.length > 0 ? 1 : 0);

Run against a fixture tree holding one file per pattern plus a few deliberately safe files — seven files total — the output is this.

BLOCK  src/lib/formula.ts:3  [function-ctor] The Function constructor is treated the same as eval
        const fn = new Function(...keys, `return (${expr});`);
BLOCK  src/lib/formula.ts:7  [eval-call] A string is being executed as code
        return eval(expr);
BLOCK  src/lib/plugins.ts:2  [remote-import] A remote module is loaded at runtime
        const mod = await import(`https://cdn.example.com/plugins/${name}.mjs`);
REVIEW src/screens/Help.tsx:3  [webview-inject] Check where this injected JS comes from
        return <WebView source={{ html: html }} injectedJavaScript={boot} />;
REVIEW src/screens/Help.tsx:3  [webview-html] Check whether arbitrary HTML can reach this
        return <WebView source={{ html: html }} injectedJavaScript={boot} />;
REVIEW src/screens/Router.tsx:5  [remote-screen-map] A remote value selects which implementation runs
        return components[remote.screen];
 
scanned 7 files / block 3 / review 3

The file that recolors the UI from remote config and the file that renders a catalog JSON both came back clean. Receiving values from a server does not trip it. Treating a received value as code does. That was the whole design intent, and it held.

A single BLOCK exits with status 1, so dropping it into CI turns it into a gate. I run it ahead of EAS Build.

# excerpt from .github/workflows/preflight.yml
- name: Scan for 2.5.2 risks
  run: node scripts/scan-2-5-2.mjs src app

One caveat when you wire it up. If generated Expo Router output or build artifacts fall inside the scan path, you will get BLOCKs on code you never wrote. In production, add your project's generated directories to SKIP_DIR to work around it. Skip that step and nobody reads the log after the first week.

The false positives came from strings, not comments

Writing this, the thing I braced for was comments. A file with a note saying "never use eval here" firing a warning would be annoying, so isComment went in early.

Running it against deliberately tricky code, the miss landed somewhere else entirely.

const retrieval = (q: string) => q;             // not flagged (as intended)
const msg = "eval( is not allowed in this app";  // <- flagged as BLOCK
// eval(dangerous)                               // not flagged (as intended)
export const upsert = (db: any) => db.eval("noop"); // not flagged (as intended)

That file came back scanned 1 files / block 1 / review 0, and the only hit was a string literal. The comment fell out exactly as designed.

So the source of noise is string literals, not comments. Worse, the projects most likely to contain a sentence about banning eval are the ones already being careful about it. The teams paying attention get the false positive.

The same run exposed a place where the exclusion is too aggressive. db.eval("noop") is not flagged, because the [^.\w] guard drops any eval preceded by a dot.

Removing that guard is instructive. Plenty of unrelated libraries expose an .eval( method, and BLOCK counts explode. A check that produces a pile of BLOCKs is a check that gets ignored. I chose durability over coverage and kept the guard, reasoning that dot-qualified method calls are rarely your own code-generation path anyway.

Because it tolerates misses by design, this script does not certify anything. It is a way to know where to look during the read-through you do before submitting.

WebView, or hand it to the browser

The WebView findings land in REVIEW because no regex can settle them. That call is a design decision.

If you want one axis to decide on, use this: who changes the contents of that screen next?

That last row is the crux of the story this article opened with. Preview a generated artifact inside the app and you have built a structure where the app's capabilities keep growing at runtime. Open it in the browser and the thing doing the running is the browser, not your app.

The second option is a worse experience. You push the user out of your app. I still consider that the cheaper price compared with operating an app whose updates can be halted.

If you keep the WebView, I recommend pinning the injected JS to a constant that lives in your repo. For the bridge design itself, I wrote up the correlation-ID approach separately in postMessage in a WebView is fire-and-forget: designing a bridge that pairs requests with responses.

Where the line sits across six apps

In the wallpaper apps, exactly three things are remotely changeable: catalog contents, display thresholds, and copy.

That limit was never about App Review. It was about reducing accidents. The wider your remote surface, the more easily you can alter production behavior from a laptop at midnight. It also fights with a staged rollout that starts at 5% and climbs while you watch crash-free numbers — if anything can be changed remotely, staging the rollout means less.

As it turned out, the constraint doubled as 2.5.2 insurance. A line drawn for operational safety happened to land on the safe side of review, which is the honest version of how it went.

Adding something new, the order of questions has not changed. First: does this need to be remotely changeable at all? Then: if it does, is what changes the data, or the logic? If it is the logic, it belongs to EAS Update, not to remote config. Both are "change it later," but the road determines how it is treated.

When flags start piling up, Before your feature flags sprawl: naming, staged rollout, and kill switches across six apps covers the cleanup.

Especially while review times are long

Roughly 560,000 new apps were added to the App Store in the first half of 2026 alone, and developers have reported waits of several weeks for approval.

In that climate, a 2.5.2 rejection hurts for a reason that has nothing to do with the finding itself. After you fix it and resubmit, you go back to the end of the same queue. Deleting one line still costs you the full wait a second time.

A few seconds of scanning before submission removes the need to gamble those weeks. As cost-benefit trades go, it is unusually clear.

What to do next

Run it once at the root of your project.

node scan-2-5-2.mjs src

Zero BLOCKs means this is not your problem today. One or more means the next step is deciding whether that line receives data or produces logic. The first is a refactor; the second means walking a design decision back.

As an indie developer, plenty of review problems can wait until you actually get rejected. 2.5.2 is not one of them — a rejection there usually means rebuilding the feature, not patching it. That makes it one of the few worth checking up front.

I am still working out exactly where my own line belongs. If this helps you find yours a little faster, I am glad.