The app submitted for review has to be the complete, self-contained product — it can't fetch and run executable code, scripts, or plugins after install that change its core functionality beyond what was reviewed.
Common with apps that use a remote-config or scripting SDK, often for A/B testing or hotfixes, in a way that changes app behavior beyond simple content or copy updates.
"Your app downloads code in a way that introduces or changes features or functionality without being reviewed, per guideline 2.5.2."
Guideline 2.5.2 says an app must be self-contained. It cannot download or run code after installation that changes its main purpose beyond what App Review saw. The reviewed binary is meant to be the complete product, so remote scripting and plug-in systems that alter behaviour fall under this rule.
App Review can only approve what it can inspect. If an app can download new executable logic later, the version that was reviewed may not be the version users actually run, and the review loses its meaning. The self-contained requirement closes that gap, so that what Apple tests is what ships. It is also a security measure, because downloaded code is a classic route for introducing behaviour that no one checked.
No. Content and parameters are fine. Changing the app's core functionality is not.
Some educational or game uses are allowed within defined limits.
Ordinary bug fixes ship in updates. Executable remote patching is risky.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.