What to do if your build is held for review

If you open your build page or your email and see that a build is "held for review", the link has not been deleted. It still has the same address, but it takes no installs until a person at AppForShare looks at it. This guide explains why a build can be held, what your testers see, and what to do so the review goes quickly.

Why builds are held

There are three reasons a build is held, and the email or the build page tells you which one applies.

• A match in the malware check. Every upload is checked for known malware with ClamAV and a MalwareBazaar hash lookup. When either one matches, the build is held and the account owner gets one email naming the signature that matched. See the malware check.
• Reports from testers. Anyone can report a build from its install page with a reason. On Free and for guest uploads, a report that looks real or unclear holds the build. On Pro and Team, you get a warning email and the build keeps working until 5 different people have reported it. See how reports work.
• A guest Android upload with a surveillance style set of permissions. An upload without an account that asks for things such as reading SMS and the call log together with an accessibility service is held for a person to look at, because spyware and parental control apps ask for the same permissions. The guest manage page shows the hold.

What your testers see

The install page says "Held for review" in the tester's language and offers no install button. Channel links skip the held build and keep opening the build before it, so testers on a channel are not stuck. Apps already installed on phones keep working.

What to do

1. Read the reason. The email and the build page say why the build was held: the signature that matched, or the report category and text. You never learn who reported a build.
2. Check the build. For a malware match, look at what went into this build: a new SDK, an ad or analytics library you added, a third party plugin, a file downloaded during the build. Compare it with the last build that was not held. Run the same file through a second scanner if you have one. For a report, read the text and decide whether there is something to fix, such as a confusing login screen that looks like phishing.
3. Reply with what you found. Reply to the email or write to [email protected]. Say what the app is, who it is for, and anything that explains the match or the report, for example "this is our own payments SDK, here is its public page" or "the tester did not have the password". Short and specific is best.
4. Keep testing on the build before it. If you use channels, testers already get the previous build. If not, share the last good build while you wait.
5. Do not work around the hold. A new upload of a file that matched known malware matches again, and once a build is removed, the same file is refused. Talking to us is the quickest way.

What happens next

A person at AppForShare decides. If the build is released, the link takes installs again, and a build released after a malware match is not held again for the same signature. If it is removed, the file cannot be uploaded again. You cannot lift a hold from your own dashboard, by design: the decision belongs to someone who did not upload the file.

If the match was right

Sometimes a held build shows a real problem: a compromised build machine, a tampered dependency or a plugin that changed hands. Treat it like any security incident. Rotate the signing keys and API keys the build machine could reach, check your dependencies against their sources, rebuild from a clean machine, and tell your testers to remove the old build. Then upload the new build as usual. The security checks before sharing a build guide covers the habits that make this less likely.

Common questions

Was my build deleted?

No. A held build keeps its file and its link. Nothing is deleted automatically.

Do my testers see why it is held?

No. They see "Held for review" only. The reason goes to the owner.

How do I ask for a review?

Reply to the hold email or write to [email protected] with what you found.

Can a paid plan lift a hold?

No plan lifts a hold. Every plan is checked the same way, and a person decides every release.

The malware check docs list each status you can read from the API and the CLI.