Select the right artifact
Identify whether the path is an Xcode archive, an exported IPA, a debug build, or a support bundle. An internal archive may legitimately contain resources that do not belong in a public download. Start with the exact package offered to customers and keep its original bytes unchanged during inspection.
Record the export channel, build identifier and intended architectures. A file extension alone does not show that a package is appropriate for production. Keep the build pipeline evidence nearby so an exposure report can be traced back to the configuration that created the package.
Interpret the scanner result precisely
CloneGuard can inspect bounded ZIP members in supported IPA inputs without extraction. It looks for known exposure patterns and inventory information; it does not reconstruct the full program or perform a semantic analysis of every Mach-O image. Check the report for skipped, oversized, encrypted or otherwise unassessed surfaces.
The default scanner limits include entry counts, total bytes, archive depth and expansion ratio. These prevent a local check from consuming uncontrolled resources. If a deliberate larger scan is appropriate, adjust supported byte limits explicitly and retain the settings with the report. Do not treat incomplete screening as a clean release.
Fix the build instead of patching the export
If an unexpected key file or debug artifact appears, find the build phase or copy rule that introduced it. Remove it from the public distribution path while retaining legitimate private diagnostics. Rebuild and export through the supported Apple workflow so required signatures and metadata are recreated correctly.
Loose-web staging is intentionally unsuitable for an IPA or signed app bundle. Deleting archive members by hand can invalidate integrity or package assumptions. A successful ZIP edit is not evidence that the result will install, launch, accept updates or satisfy the intended distribution channel.
Combine independent checks
Run native signature and entitlement checks in the distribution environment. Exercise installation, launch and critical workflows on supported targets. Record unavailable devices or tools as unrun. A simulator result cannot stand in for a production device signature or an App Store outcome.
After the export is final, create a release receipt outside the artifact tree and verify the exact downloaded copy against it. CloneGuard can hash an opaque outer package even where internal inspection is limited, but that inventory result must not erase the limitation on inspecting its contents.
Keep the raw report private if filenames or paths disclose implementation detail. A public summary should describe the findings, corrections and remaining coverage, rather than claiming that an IPA audit made Swift code unreadable to REA or to a native decompiler.
Practical checklist
- Confirm the artifact is the intended export.
- Read incomplete and skipped-surface fields.
- Fix copy rules and rebuild natively.
- Validate devices and signatures separately.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.