App Transport Security exceptions App Review will ask about
Turning App Transport Security off for everything is allowed, but it is something you have to justify, and a blanket exception in a submitted build invites the question. An exception for a development host is a different problem: it says the build still points somewhere it should not.
Why it matters
NSAllowsArbitraryLoads disables ATS for every domain the app talks to. It is usually added to unblock one insecure endpoint during development and then never narrowed, so the shipped app has transport security switched off wholesale for the sake of a server that has since moved to HTTPS.
NSAllowsArbitraryLoadsInWebContent is narrower and often legitimate, because web content you do not control cannot be held to your transport rules. It is still worth being deliberate about rather than inheriting it.
An exception naming localhost, a .local hostname or a private LAN address makes no sense in a shipped app: it only has an effect on a machine that can reach that host. Its presence is evidence the build is still configured for a development environment, which is the thing worth catching before submission rather than after.
How to fix it
- Open Info.plist and read the NSAppTransportSecurity dictionary.
- Remove NSAllowsArbitraryLoads if every endpoint you call is now HTTPS, which is the common case once a project is a year old.
- If one host genuinely needs an exception, replace the blanket flag with an NSExceptionDomains entry for just that host, so the rest of the app keeps ATS.
- Delete any exception naming localhost, a .local host or a private address range before you archive.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
App Transport Security exceptions. Broad ATS exceptions must be justified to App Review.
- A blanket NSAllowsArbitraryLoads.
- Web-content exceptions, reported separately because they are more often legitimate.
- Exceptions naming localhost, .local hostnames or private network ranges, which are reported as development leftovers.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.