Google Play denial of Service (DoS) policy: fixes and checks

Google prohibits code that uses a person’s device for a denial-of-service attack without their knowledge. A bundled component that quietly generates attack traffic can put your app in this category.

What to check

Inspect network loops, remote task execution, proxy SDKs, and unusual background traffic. Trace request bursts to a feature and an intended destination. Include behavior triggered by server commands rather than a visible user action.

Separate ordinary retry bugs from attack functionality, but investigate both. A retry loop that overwhelms a service still needs correction even if its cause wasn’t malicious.

How to address the rejection

Remove attack capabilities and affected dependencies. Stop uncontrolled retries and restrict legitimate network jobs to their intended purpose and lifetime.

Verify traffic from the release build when idle, under failure, and after remote configuration loads. In your response, identify the source of the requests and show why the corrected build no longer participates in the flagged activity. User consent doesn’t authorize attacks against someone else’s systems.