Guideline 2.5.2 - Software Requirements: Code Injection or Hot-Patching

Apple is rejecting your app because it downloads and executes code that was not included in the original binary submitted for review. This covers JavaScript-to-native bridges that execute arbitrary native code, hot-patching frameworks like JSPatch or Rollout, and any mechanism that can modify the app's native behavior after Apple has approved it. This is one of Apple's hardest lines. The reasoning is straightforward: Apple reviews a specific binary and approves it. If the app can download code that changes its behavior after approval, Apple's review is meaningless. This guideline was created largely in response to JSPatch, which was widely used in the Chinese developer community to push native code changes without going through App Store review. Important nuance: JavaScriptCore and WKWebView can execute JavaScript, and that's fine -- Apple's concern is specifically about JavaScript (or any other code) that bridges to native APIs in ways that weren't present in the reviewed binary. React Native and similar frameworks are generally acceptable because the JavaScript they execute interacts with a fixed set of native bridges that were reviewed. But dynamically downloading new native bridge code is not acceptable.