How do you give the reviewer credentials for using the app? Did you just mark the app as login not required, or did you give them some specific nsec to use the app with, or something else?
I got an app passed by adding a hardcoded check in the frontend to hide certain features from the reviewer by checking the phone number of the logged in user