New Detection Capabilities That Prevent Costly App Store Issues

March 2026: SDK Governance, Font Detection, iOS Rules

March was the biggest build month since AppCompliance started. The rule engine expanded with full iOS coverage, font detection now supports over 1,700 commercial typefaces, and a full SDK governance system shipped. Here's what changed and why it matters for your compliance workflow.

What does SDK governance do for your compliance workflow?

The biggest addition this month is SDK Governance. When you scan an IPA, APK, or AAB, AppCompliance now automatically discovers SDKs in your binary, identifies unknown or unrecognized libraries, and enriches each detected SDK with metadata: category, known data collection behaviors, and privacy implications.

This isn't just a list. The governance page shows you which SDKs were detected, how they're classified, and whether they align with your team's allow/blocklist policies. You can flag SDKs for review, mark them as approved, or add them to a blocklist that triggers findings on future scans.

SDK discovery and enrichment run automatically after each scan. No configuration needed. The governance dashboard and allow/blocklist management are available on paid plans. Detection data is visible on all plans.

How does font detection work across 1,700+ commercial fonts?

AppCompliance now detects over 1,700 commercial font families in app binaries, using a lookup-based detection system that matches font filenames against a curated database of commercially licensed typefaces.

Why does this matter? Font foundries actively enforce licensing. A font embedded in your binary without a proper license can lead to legal claims. The detection covers the long tail of commercial fonts that agencies and design teams commonly use, not just the obvious ones like Helvetica Neue or Proxima Nova.

Each detected font is classified as Commercial, Safe (open-source), or Unknown. Commercial fonts surface as findings with licensing context. Safe fonts like Inter, Roboto, and Open Sans don't trigger findings.

What changed in iOS rule coverage?

The rule engine now has full iOS coverage with checks for:

• Privacy manifest validation (required reason APIs, tracking domain declarations)
• App Transport Security configuration (overly broad exceptions, missing justifications)
• Entitlements and capabilities checks
• Minimum deployment target verification
• Binary architecture requirements

The snapshot system covers 36 active iOS rules and 19 intellectual property rules. Rules can be updated without code deployment, so new Apple requirements can be reflected quickly.

How does handler confidence help you prioritize findings?

Every check type in the rule engine now has a confidence classification. When AppCompliance evaluates a rule against your binary, the finding includes a confidence level: high, medium, or low.

High confidence means the detection is deterministic. The binary either contains the pattern or it doesn't. Medium confidence means the detection relies on heuristic matching. Low confidence means the check uses indirect signals.

This helps your team prioritize findings. A high-confidence finding about a missing privacy manifest is different from a low-confidence heuristic match on an SDK pattern. The confidence level is visible in scan results on all plans.

API rate limiting

API endpoints now enforce per-tier rate limits and token lifetimes. This prevents a single integration from overwhelming the scan pipeline and ensures fair usage across all workspaces.

The rate limits are configured per plan, with higher limits on higher plans. CI/CD scanning works on every plan, but high-volume API usage is better served by a higher plan.

Performance: faster scans, less memory

Two performance improvements shipped in March. The cross-platform analysis service is now 36% faster thanks to a three-layer caching strategy. And the scan pipeline eliminated duplicate ZIP extraction, reducing memory usage for large binaries.

For teams scanning binaries over 100MB, these improvements mean faster turnaround and fewer timeout issues. The scan timeout default remains at 900 seconds (15 minutes), but most scans now complete well under that threshold.

Security: safer binary handling

Binary analysis requires extracting and inspecting untrusted files. March's security improvements added safe ZIP extraction with path traversal protection and hardened the extraction pipeline against malformed archives.

These are infrastructure changes that don't affect your workflow directly. The binaries you upload are handled more safely, and the scanning pipeline is more resilient to edge cases.

What's next

The immediate roadmap includes Android snapshot rule completion (13 rules are in progress), severity visibility configuration (so you can hide severity levels your team doesn't track), and expanded CI/CD integration documentation.

Want in early? Join the waitlist and we'll bring you on as access opens.