According to Apple allows hot code push in mobile apps, by Alice Yu in October 2014, the App Store reviewers allow code to be downloaded and run as long as it is:
- Not executable code, only interpreted.
- Downloaded and run by Apple's Webkit.
- A small change i.e doesn't change the purpose of the app.
These conditions have been used as a loophole by frameworks such as Meteor, Cordova/Phonegap & even the likes of Cocos2djs. While Meteor & Cordova are based on the iOS webview, they are downloaded and run via webkit, but Cocos2djs is based on spidermonkey and has the ability to update game content and scripts via Cocos2djs' "Asset Manager" i.e not webkit (webview).
- Only interpreted code/scripts.
- Downloaded and INITIALLY run by Apple's Webkit before being sent to an interpreter for further execution.
- Making changes that do not change the purpose or intent of the app.