Where does it say it needs to be added to both? This seems to be the behavior I'm observing as well for an SPM that has it's own PrivacyInfo.xcprivacy -- https://github.com/bugsnag/bugsnag-cocoa -- I still get flagged for the API reasons unless I also declare them in my App.

I just tried it... no dice unfortunately Xcode rejects the app-specific password.