“sandbox”

A macOS app that never reads or writes notes cannot update a contact that has a note property. CNSaveRequest.update() throws NSCocoaErrorDomain 134092 with NSUnderlyingException Unhandled error (NSCocoaErrorDomain, 134092) occurred during faulting. CNContactNoteKey is never requested. I reduced it to a minimal app whose only action is toggling familyName, and confirmed the cause in both directions: Create a contact programmatically. The update succeeds. Add a note to it in Contacts.app. The identical update now fails with 134092. Set that note to an empty string. Still fails. Remove the note property entirely. The update succeeds again. Contacts imported from a vCard fail from the start, even when the vCard has no NOTE line and Contacts.app shows no note. Clearing the note property on such a contact also makes the update succeed, so I believe the import attaches the property invisibly. Ruled out: mutableObjects instead of mutableCopy, including or omitting CNContactNoteKey, unified versus non-unified fetches,

I see different storefronts in StoreKit product queries and Apple’s purchase sheet when testing through TestFlight. Xcode-installed builds work normally. iPhone — iOS 26.6 (23G71), US Media & Purchases account Both StoreKit 1 and StoreKit 2 return CHN/CNY. The app displays CNY 128 for a non-consumable, but Apple’s sandbox purchase sheet shows USD 29.99 for the same product. This reproduces in a standalone 177-line Swift sample using Product.displayPrice directly, with no third-party dependencies, currency conversion, or local .storekit configuration. Reloading products and signing out of the sandbox account did not resolve it. Mac Catalyst — macOS 26.3 (25D125), China purchase account The original TestFlight app returns USA/USD. Purchasing shows “Account Not In This Store” and asks to switch to China, although the purchase account is already set to China. The Mac symptom has not yet been verified in the standalone sample. Reproduction on the affected iPhone: install via TestFlight, load

Security concern: To provide a visually appealing transition when launching or leaving an application, iOS introduced a feature that automatically captures a screenshot of the current view when an app is moved to the background. This screenshot is subsequently displayed as a preview in the App Switcher. There is security concern that the app shows sensitive information like activation codes or chat histories in the preview image of the App Switcher Need clarification on the following points: 1.Where exactly are these App Switcher preview screenshots stored on the device filesystem? 2.Can these App Switcher snapshots be accessed on a jailbroken iOS device? 3.Are these snapshots stored inside the application container or in a system-managed location outside the app sandbox? Can any Third party application or tool can access this screenshots in iOS device? 5.Is there any Apple-recommended API, entitlement, or platform-supported mechanism on iOS to prevent screenshots in iOS

Hello, We ship a font provider app that installs fonts system-wide on iOS, delivering the font files through On-Demand Resources. Since iOS 27 shipped, customers have been reporting that their installed fonts vanish from the system font list after every restart. I would like to know whether the restore path for system-wide font registrations changed in iOS 27, and what a font provider app is expected to do after a device reboot. Environment iOS 27.0 and 27.0.0 only. We have no reports on iOS 26 or earlier. iPhone 18 Pro and iPhone 18 Pro Max Fonts delivered through On-Demand Resources and registered for system-wide installation using CoreText Steps to reproduce Activate a font in the app. It appears in Settings > General > Fonts. Reboot the device. Without launching the app, open Settings > General > Fonts. The font is gone. The app still shows the font as active, because it keeps its own activation state. Deactivate and reactivate the font in the app. It comes back. Reboot again. It disappears ag

Hi— App review said: The app uses one or more entitlements which do not have matching functionality within the app. Apps should have only the minimum set of entitlements necessary for the app to function properly. Please remove all entitlements that are not needed by the app and submit an updated binary for review, including the following: • com.apple.security.device.camera • com.apple.security.network.server …but my app has a feature that does use the camera (continuity camera for macOS, and a bonjour feature for finding other local app instances, establishing a link, and sending data to other instances. I’ve tried declaring/justifying talking about it in App testing info and in my reply to the reviewer, about how to access the features that require it. do I really not need these entitlements and only seems like I would? do I simply test app scheme Release > no debug executable with fresh sandbox and see if features break? But no declaring these things seems like the opposite of what Apple would

Environment: App: Developer ID signed, non-sandboxed macOS app Browsers affected: Google Chrome, Mozilla Firefox Safari: Working fine on macOS 27 Working on: macOS 26 and earlier Broken on: macOS 27 (Golden Gate) Issue Our non-sandboxed, Developer ID signed macOS app interacts with Chrome and Firefox directories under ~/Library/Application Support/ as part of its browser extension deployment workflow. On macOS 26 and earlier, this worked without any special permissions. On macOS 27, the same operations are silently blocked — no TCC prompt is shown to the user, access is simply denied. Granting Full Disk Access to our app via System Settings > Privacy & Security > Full Disk Access resolves the issue completely on macOS 27. Safari is unaffected — our Safari extension is bundled directly inside our app and continues to work correctly on macOS 27 without any additional permissions. Question Has macOS 27 intentionally introduced TCC or MACL-based protection over Chrome and Firefox direc

I am currently having issues getting tap to pay to work locally for development. I have: the tap to pay development entitlement a verified test device a test sandbox user tap to pay / NFC / app apptest capabilities the correct provisioning profile We are currently working a payment service provider NMI to support tap to pay. Part of that process has been getting entitlements, and we now have the developer entitlement for tap to pay. We are having an issue with an account not linked error. We have been told by NMI this is an issue on Apple's side since we have the correct provisioning profile, capabilities, and entitlements set up for our company. This issue is when using a sandbox account. When I use a developer account I get an invalid apple account issue. Any combination of user / provisioning profile / and capabilities that I have tried have not produced better results. Versions: IOS version is 26.6 and xcode is also 26.6. I have followed these steps: https://developer.apple.com/forums/th

Following the guidance in the locked thread Reporting your App Store Server Notifications issue (https://developer.apple.com/forums/thread/774053) and a DTS support request on the same topic, I am posting this issue with the Feedback Assistant ID requested there: FB24820430. Summary: This is a content anomaly in Apple-signed App Store Server payloads, not a notification delivery problem — our server receives and verifies every notification; the defect is in the field values themselves. For a stable subset of subscription families, purchaseDate in JWSTransactionDecodedPayload is consistently ~8 hours later than the signedDate of the very same JWS — a purchase recorded as happening after the signed document reporting it existed. Reproducible field comparison inside one and the same Apple-signed JWS: Field relation Affected transactions Unaffected (control) transactions purchaseDate − signedDate +7h54m … +7h59m (never ≤ 0) ≈ 0 (seconds) Webhook arrival at our server ≈ signedDate (seconds to minutes), never ≈ pur

Hello, We are seeing what appears to be a regression in the Core ML multifunction ML Program loading path on macOS 27.0. A compiled multifunction ML Program is correctly recognized by MLModelAsset and MLModelStructure, but loading either named function through MLModel fails with an error claiming that the model is not an ML Program. Environment macOS 27.0 Build: 26A428 Apple silicon Mac BABANE 1.0.4, build 16 Application built with the macOS 26.5 SDK Reproduces both inside and outside App Sandbox Approximately 98 GiB of disk space is available Public reproduction BABANE is available from the Mac App Store: BABANE on the App Store Apple engineers can reproduce the issue without receiving a separate model archive: Install BABANE from the App Store on macOS 27.0. Download either available translation model in the app. The model is delivered using Apple-Hosted Background Assets. Trigger model loading by starting a translation. Core ML fails while loading the first named function. The downloadable models