• State Not Answered
  • +1 person also asked this people also asked this
  • Replies 27 replies
  • Subscribers 9 subscribers
  • Views 2187 views
  • Users 0 members are here
Options
Related

Automated security scan rejects app with identical generic message across 4 substantially different binaries

OGN1

App: ALLCALENDAR - Calendar, Events & Reminders

App ID: b87620ff-a148-4859-8287-1c946b2ba234

My app was pulled by an automated scan ("An automated scan identified a security threat...") with no detail on the actual finding, and was removed from the store the same day, after an update submission. Since then I've resubmitted 4 times, each with a substantially different binary, specifically targeting things that could plausibly look risky to an automated scanner:

1) Removed the entire calendar-sync (ICS) feature and its network code - zero Communications.makeWebRequest calls related to it, feature stripped from settings too.

2) Removed a settings field that let the destination server address be overridden (an "arbitrary outgoing request target" pattern).

3) Removed a set of bare domain strings (no scheme prefix) that were present as a client-side allowlist.

4) Restored/varied the above between attempts.

All 4 submissions were rejected with the exact same templated email, no additional detail in either the email or the developer dashboard.

I've read a similar report here: "New listing inherits state from a deleted one - every upload rejected by the automated security scan" - in that case the cause turned out to be content (a bare-domain string), which I've now also removed, with no change in outcome for my listing.

Given the rejection appears insensitive to meaningfully different binary content, could someone from the Connect IQ team check whether this specific listing/App ID has a stuck or inherited review flag independent of the uploaded package? Happy to provide any binary/diff needed. This has kept a paid, previously-live app (100+ installs, 4.3 stars / 12 reviews) off the store since today.

Also emailed [email protected] but wanted to raise it here too in case someone can take a quicker look. Thanks!

  • 0

    It wouldn't surprise me if the AppId you used when the app was first blocked and removed can no longer be used on the updates you are trying to do and you need to use a new Appid.

    About why it was first blocked, were you collecting any user data to your own site, or did you use logos without permission of the copyright holder?

  • 0

    Thanks for the pointers. No logos involved. Data collected was just an app-scoped device ID (Garmin's per-app unique identifier), sent to our own server only to recognize the device for trial/license status — no email, name, or location. We've since added a privacy policy link to the listing, since it was missing. Still no word from Garmin on the actual scan finding.

  • 0 in reply to OGN1

    Have you tried using a new AppId sine the app was first banned and removed?  Once an app is removed. the same AppID can no longer be used.  Even in the case where a dev removes their own app.

  • 0 in reply to jim_m_58

    Thanks - that matches what we're seeing (5 different resubmissions, including a real fix like adding the missing privacy policy, all rejected identically, and the listing is currently invisible to anyone but me). Before committing to a new AppId (losing reviews/rating, requiring existing users to manually reinstall), we'll give Garmin a bit more time to respond directly. Do you know if there's any way to preserve continuity for existing installs/reviews when moving to a new AppId, or is it a clean break?

  • 0 in reply to OGN1

    Update: to settle this, I re-uploaded the exact original .iq package from my very first approved release (June 2026, byte-identical, predating every change I've made since) - rejected with the same identical templated message. That's 7 different submissions now (6 varied binaries plus this original one), all rejected identically regardless of content. That confirms it's this AppId/listing, not the package.

    Going with a new AppId as you suggested. Thanks for the help narrowing it down - will report back once the new listing is up.

  • 0

    I am seeing the same issue.

    Uploaded the previous version that was accepted before and got email for that too.

    Annoying!!

  • 0 in reply to HermoT

    I have uploaded a new version where the only changes were:

    1. Removal of  <iq:product id="epix2pro47mmsystem7preview"/> which existed in manifest.xml by mistake ever since the app was first uploaded

    2. Correction of the x coordinates in two .fnt resource files

    3. Version number increment in two files (a const string in .mc and a string property)

    And got an email saying: An automated scan identified a security threat in the Digidelic app.

    It made me very sad. I feel a bit better now, knowing I'm not alone Slight smile

  • 0 in reply to ReedWorks

    Then I think this is a global issue and not just a wrong app id or mistake on the developer side.

    The bad thing is that the app store shows your new version for the uploaded app, and it looks like everything is fine.

    But whenever people install your app they get an old version I think. I tried by installing and didn’t experience / see the changes I made, so definitely not installing the latest advertised version.

  • 0 in reply to HermoT

    It looks like anything I upload gets flagged. Just tried to update a beta of my other watch face, got the same security threat email.