Why Vibe Coded Apps Keep Getting Rejected

The Anything app got pulled from the App Store on March 26, 2026. Restored April 3. Pulled again. Its co-founder tried four technical rewrites to comply. Apple removed it anyway, saying the app "marketed itself as a mobile app builder" in violation of Guideline 2.5.2. Anything had raised at a $100 million valuation. Apple still killed it twice.

This is why vibe coded apps keep getting rejected from the App Store, and the reasons have almost nothing to do with Apple hating AI. Most vibe coded apps break rules that have existed for years, fail quality standards that apply to every app, and the people building them often have no idea either of those things is happening.

Apple didn't change the rules. Vibe coders just started breaking them.

Guideline 2.5.2 has been in Apple's App Review Guidelines for years. It says apps "may not download, install, or execute code which introduces or changes features or functionality of the app." The rule exists because Apple's entire review model depends on a simple premise: the app you submit is the app users get. If your app can transform itself after review, the review is meaningless.

Vibe coding platforms like Replit, Vibecode, and Anything let users generate entirely new applications inside the host app using natural language prompts. That's the product. It's also a textbook violation of 2.5.2, because the app that Apple reviewed is no longer the app running on the user's phone. The code changed after review. That's the line.

Apple blocked updates for Replit and Vibecode on March 18, 2026. It pulled Anything on March 26. Anything's co-founder Dhruv Amin told TechCrunch that on a call with Apple, the company said the app was removed because of the "potential it could be used to download malicious code." An Apple spokesperson told The Information that the company was "not targeting vibe coding apps specifically" but enforcing "long-standing rules." Meanwhile, Apple has been adding its own agentic coding features to Xcode 26.3. Apple doesn't have a problem with AI writing code. Apple has a problem with apps that shapeshift after review.

Here's the part that matters for individual builders: if you used Cursor, Claude Code, or any other AI coding tool to write your app, and you're submitting a standalone native build through App Store Connect, Apple does not care how the code was written. The code's origin is irrelevant. What matters is whether the app meets Apple's published quality standards. A vibe coded app that compiles to a normal native binary and passes review is exactly as welcome as any other app.

The apps getting rejected aren't getting rejected for being vibe coded. They're getting rejected for being bad.

The App Store is drowning, and vibe coded apps are most of the flood

App Store submissions had been declining for nearly a decade. From 2016 to 2024, new app submissions fell 48%, according to Sensor Tower. Then vibe coding happened.

In Q1 2026, 235,800 new apps were submitted to the App Store, an 84% increase over Q1 2025, per data from The Information citing Sensor Tower. Full-year 2025 saw roughly 557,000 new submissions, the largest annual wave since 2016. Apple was processing around 200,000 submissions per week at peak volume.

The review infrastructure buckled. Developers submitting in March 2026 reported review delays of seven to 30 days, against a historical baseline of 24 to 48 hours. Apple told Business Insider that 90% of submissions are still reviewed within 48 hours with an average review time of 1.5 days, but the gap between Apple's claim and developers' reported experience suggests the remaining 10% are waiting considerably longer.

The math is brutal for vibe coders. Apple's 2024 App Store Transparency Report shows the company reviewed 7.77 million app submissions and rejected roughly 25% of them: about 1.93 million rejections. That's the baseline rejection rate for apps built by people who (mostly) know what they're doing. Now flood the system with apps built by people who have never read a single App Store guideline, and the rejection rate for vibe coded submissions is almost certainly higher.

The six reasons your vibe coded app got rejected

Apple's review process checks five categories: Safety, Performance, Business, Design, and Legal. Vibe coded apps fail disproportionately in Performance and Safety, because AI-generated code optimizes for "does it work" rather than "does it work reliably, securely, and within Apple's specific constraints."

1. It crashes. This is the most common rejection reason for all apps, and vibe coded apps are especially vulnerable. Apple has, per multiple developer accounts, "very low tolerance" for apps that crash, freeze, or become unresponsive during review. If a reviewer encounters a single crash, the app fails. AI-generated code that works fine on your device can fail on different device models, iOS versions, or network conditions. Testing on a simulator is not enough. TestFlight testing on physical devices, which is free and included with Apple's $99/year developer program, is not optional.

2. Your privacy policy is missing or incomplete. Every app submitted to the App Store requires a valid privacy policy URL. Every app must include a Privacy Nutrition Label in App Store Connect disclosing exactly what data is collected and how it's used. In 2026, Apple tightened these requirements further: apps using external AI services must include a consent modal specifying the provider and data types before any personal data is shared. Most vibe coding tools don't generate privacy policies. Most vibe coders don't write them. Apple rejects the app.

3. You didn't include a demo account. If your app requires a login, Apple's reviewers need a way to test it. No demo account means the reviewer can't get past the login screen, which means they can't review the app, which means it gets rejected. This is in Apple's guidelines. It has been in Apple's guidelines for years. Vibe coders skip it because the AI didn't remind them.

4. Your code has security vulnerabilities. Veracode's analysis of four million code scans found that AI-generated code contained security flaws 45% of the time. The Cloud Security Alliance put the number at 62%. A penetration testing firm audited 15 vibe coded applications and found 69 vulnerabilities, six of them critical. Apple's review process includes automated security scans, and apps with obvious policy violations get flagged. But even the vulnerabilities that slip past Apple's review (and many do) will surface once real users and real attackers start poking at your app. Row-level security disabled on your database, hardcoded API keys in client-side code, missing authentication on API endpoints: these are exactly the kinds of shortcuts AI code generators take, and exactly the kinds of problems that will eventually catch up with you.

5. Your app isn't self-contained. Beyond the platform-level Guideline 2.5.2 issue, individual apps can violate this rule too. If your app downloads code, scripts, or executable content from a remote server after installation, it violates 2.5.2. If your app uses a web view that effectively becomes a different app depending on what the server sends, Apple will flag it. Vibe coded apps that rely heavily on server-side logic with client-side rendering can inadvertently cross this line.

6. Your app doesn't explain its AI features. Apple's 2026 guidelines require that apps using AI to generate content, give recommendations, or make automated decisions must "clearly explain how they work." Apps that "mislead users about AI capabilities or hide automated processes" face rejection. If your app uses AI under the hood and you didn't disclose it in the app description or within the app itself, that's a rejection.

The real cost of getting an app on the App Store in 2026

Before you spend weeks building an app that Apple rejects, here's what the submission process actually requires.

Apple Developer Program: $99 per year. Non-negotiable. If your membership lapses, your app gets pulled. You can register as an individual (your personal name appears as the developer) or as an organization (requires a D-U-N-S number, which can take up to 14 business days to obtain).

A privacy policy. You need a URL pointing to a real privacy policy that covers your app's data practices. This isn't a template you copy from the internet. It needs to accurately describe what data your specific app collects and what you do with it.

TestFlight testing. Apple's beta testing platform is free with your developer program membership. Use it. Test on at least three different physical devices across at least two iOS versions. Screen record the full user flow and verify that nothing crashes, freezes, or behaves unexpectedly.

App Store Connect metadata. Screenshots, app description, keywords, age rating questionnaire, Privacy Nutrition Label. All of this must be completed before submission. Starting in April 2026, all iOS and iPadOS apps must be built using the iOS 26 SDK.

Apple's commission: 15-30% of in-app purchases. Apps earning under $1 million annually pay 15%. Above that, 30%. Subscriptions drop to 15% after the first year. If your app charges money, Apple takes a cut.

Add it up: $99 per year for the developer program, plus whatever your vibe coding tool costs ($20-50/month), plus Supabase or another backend ($25/month if you exceed the free tier), plus a domain ($10-15/year). Even a minimal setup with one paid tool runs $350 to $450 for the first year. If you can stay entirely on free tool tiers, you can get it down to around $110, but most serious builders can't.

The irony: Apple is building its own vibe coding tools

While Apple was pulling Anything from the App Store and blocking updates to Replit, it was simultaneously adding agentic coding features to Xcode 26.3, its own development environment. Apple's message is not subtle: you can use AI to write code for apps. You just can't distribute an app whose primary function is letting other people use AI to write code for apps on your phone.

This isn't hypocrisy. It's platform economics. Apple's App Store review model depends on reviewing a static binary. If an app can generate new functionality after review, the review is worthless, and so is the quality guarantee Apple sells to its billions of device users. The CNBC column that called Apple's crackdown "putting it on the wrong side of history" missed this point. Apple isn't fighting AI. It's fighting the collapse of its review infrastructure under a flood of apps built by people who have never shipped software before.

Sensor Tower senior insights analyst Abraham Yousef told AppleInsider that the Q1 2026 surge aligns with "the introduction of agentic coding tools, such as Claude Code and ChatGPT Codex." Apple can see the same data. It knows the flood is coming from tools that make app creation trivially easy and app quality trivially poor.

What Apple actually wants (and what vibe coders keep missing)

Apple's review process is not mysterious. The guidelines are public. The rejection reasons are documented. The checklist is predictable. And yet vibe coders keep getting rejected because they treat app submission like uploading a file to Google Drive.

Apple wants four things: an app that doesn't crash, an app that respects user privacy, an app that does what it says it does, and an app that doesn't change into something different after review. That's it. Meet those four standards and your vibe coded app will get approved just like any other app.

The problem is that meeting those standards requires exactly the kind of work that vibe coders are trying to skip. Testing on physical devices. Writing a real privacy policy. Understanding what data your app collects. Reviewing the code for security flaws instead of trusting that the AI got it right. Reading the App Store guidelines before you submit, which is a document that exists and is free and takes about an hour to read.

Vibe coding is remarkable at generating a working prototype in hours. It is terrible at generating a production-ready, App Store-compliant application. The gap between those two things is where the rejections happen, and no amount of prompting will close it. You have to do the boring work yourself, the same boring work that every developer who has ever shipped an app on the App Store has done since 2008.

Apple doesn't care that your app was built with AI. Apple cares that your app works, that it's safe, and that it plays by the same rules as every other app in the store. The 1.93 million rejections in 2024 weren't personal. Neither is yours.