Solo first-time developer here, hoping to hear from anyone who's actually gotten past this.
My app (a personal finance app, no IAP, no payments) was rejected under Guideline 5.6 - Developer Code of Conduct: "a pattern of unusual behavior... commonly associated with fraudulent activity... features that appear to have been intentionally hidden during the review process." No sub-section named, no specifics.
I audited my own build and found two things that could honestly fit: an update banner whose text and URL came from my server at runtime, and low usage caps on the guest/demo mode reviewers use. I disclosed both to App Review myself, fixed both (store URL compiled into the binary, server only answers "is there a newer build number", caps raised with wording cleaned up), and resubmitted the new build.
The new build got the word-for-word identical 5.6 rejection.
There's genuinely nothing left: no OTA updates, no WebView, no region/date/device checks, nothing server-configurable. Which makes me think the flag is on my account's history, not the binary — earlier I had a second App Store Connect record for the same app under an old bundle ID (never released anywhere), which I removed to resolve a 4.3(a), plus several resubmits in a short window while I learned the process.
What I've done so far: replied in Messages asking them to name the specific feature (offering a screen recording and a phone call), resubmitted so the reply actually gets read, and filed an App Review Board appeal.
Questions for anyone who's been here:
Did you ever get them to name the actual behavior, and how? If it was account-level, what finally cleared it — the appeal, a phone call, time, or something else? Did removing an old app record / resubmitting quickly ever turn out to be the trigger for you? Anything you'd do differently in my position right now?
Not looking to bash App Review — I just want to comply and can't find out with what. Thanks.