App: ALLCALENDAR - Calendar, Events & Reminders
App ID: b87620ff-a148-4859-8287-1c946b2ba234
My app was pulled by an automated scan ("An automated scan identified a security threat...") with no detail on the actual finding, and was removed from the store the same day, after an update submission. Since then I've resubmitted 4 times, each with a substantially different binary, specifically targeting things that could plausibly look risky to an automated scanner:
1) Removed the entire calendar-sync (ICS) feature and its network code - zero Communications.makeWebRequest calls related to it, feature stripped from settings too.
2) Removed a settings field that let the destination server address be overridden (an "arbitrary outgoing request target" pattern).
3) Removed a set of bare domain strings (no scheme prefix) that were present as a client-side allowlist.
4) Restored/varied the above between attempts.
All 4 submissions were rejected with the exact same templated email, no additional detail in either the email or the developer dashboard.
I've read a similar report here: "New listing inherits state from a deleted one - every upload rejected by the automated security scan" - in that case the cause turned out to be content (a bare-domain string), which I've now also removed, with no change in outcome for my listing.
Given the rejection appears insensitive to meaningfully different binary content, could someone from the Connect IQ team check whether this specific listing/App ID has a stuck or inherited review flag independent of the uploaded package? Happy to provide any binary/diff needed. This has kept a paid, previously-live app (100+ installs, 4.3 stars / 12 reviews) off the store since today.
Also emailed [email protected] but wanted to raise it here too in case someone can take a quicker look. Thanks!
