Hey everyone, Curious how other iOS teams/indies are dealing with Apple's Privacy Manifests (PrivacyInfo.xcprivacy) and Required Reason APIs now that enforcement is active. Recently had to deal with third-party dependencies (both CocoaPods and SPM packages) where an undeclared API usage buried deep inside an embedded framework caused an App Store submission headache (ITMS-91053). I wanted to ask: What does your pre-submission workflow look like? Are you auditing privacy manifests and API reasons manually, using Xcode’s built-in report, or do you have a custom script in your CI/CD pipeline? Third-party SDK visibility: How do you catch when an updated dependency introduces an undeclared restricted API or tracking domain before pushing to TestFlight / App Store Connect? Local vs Cloud tooling: If you were checking compliance pre-flight, would your team ever be allowed to upload compiled .ipa binaries to a 3rd-party cloud service, or does security require everything to run 100% locally on your machine/CI runners? Is this painful enough to care? Is this just a one-time setup headache you ignore once it passes, or does dependency churn cause regular release friction? Would love to know how you guys handle this in production builds. Thanks!

How is your team handling Privacy Manifest (PrivacyInfo.xcprivacy) audits before App Store submission?

Hey everyone,

Curious how other iOS teams/indies are dealing with Apple's Privacy Manifests (PrivacyInfo.xcprivacy) and Required Reason APIs now that enforcement is active.

Recently had to deal with third-party dependencies (both CocoaPods and SPM packages) where an undeclared API usage buried deep inside an embedded framework caused an App Store submission headache (ITMS-91053).

I wanted to ask:

What does your pre-submission workflow look like? Are you auditing privacy manifests and API reasons manually, using Xcode’s built-in report, or do you have a custom script in your CI/CD pipeline?
Third-party SDK visibility: How do you catch when an updated dependency introduces an undeclared restricted API or tracking domain before pushing to TestFlight / App Store Connect?
Local vs Cloud tooling: If you were checking compliance pre-flight, would your team ever be allowed to upload compiled .ipa binaries to a 3rd-party cloud service, or does security require everything to run 100% locally on your machine/CI runners?
Is this painful enough to care? Is this just a one-time setup headache you ignore once it passes, or does dependency churn cause regular release friction?

Would love to know how you guys handle this in production builds. Thanks!