// the find
RevylAI/greenlight
Pre-submission compliance scanner for the Apple App Store and Google Play. Scans code, privacy manifests, Android manifests, and IPA/APK/AAB binaries against the review guidelines. Offline, no account.
greenlight is a Go CLI that checks iOS and Android apps against App Store and Play Store review guidelines before you submit — scanning source code, Info.plist, privacy manifests, and compiled APK/AAB binaries. It runs offline and finishes in milliseconds. Aimed at mobile developers who want to catch rejections in CI rather than after a week-long review cycle.
The binary parsing is the standout technical piece: it decodes APK binary XML and AAB protobuf manifests in pure Go, no Android SDK or aapt2 required. That removes a nasty environment dependency from CI. The 16 KB ELF page alignment check for Android 15+ is specific and correct — most teams learn about this the hard way. The severity model is honest: --exit-code also trips on a scanner crash, so a half-finished scan never silently reports green. SARIF output with GitHub code scanning integration means findings show up inline on PRs, which is the right place for a linter to surface.
The rules are regex and pattern matching over source files, not AST-based. Over Swift and Objective-C that means commented-out UIWebView calls or string literals can trigger false positives, and obfuscated or indirect calls will miss. The README is quiet on false positive rates. The guidelines freshness problem is unaddressed — App Store and Play policies change several times a year, and there is no mention of how quickly rules track those changes or how to tell if your installed version is stale. The 'one command' pitch breaks down in practice: Gradle model checks cannot run against built artifacts (Play Billing version, ads SDK detection), and merged manifest checks cannot run against source — so complete coverage structurally requires running both. Finally, the tool's own README spends considerable space explaining what it cannot catch, and the thing it cannot catch (flows that exist in source but don't work at runtime) is exactly what the paid Revyl product covers. That is a coherent business model, but adopters should know the free tool is designed to funnel them toward the commercial tier.