Releases must declare necessary permissions, data practices, remote services, ownership, and functionality accurately. Malware, credential theft, hidden tracking, deceptive behavior, unlawful functionality, impersonation, and infringement are prohibited.
Automated validation is followed by risk-based human review. Findings that indicate minification, obfuscation, dynamic code, permission escalation, or unexpected network behavior require manual review. Decisions, notices, and evidence are auditable.