Capacitor security checklist
Capacitor wraps a web app in a native shell, so an app built in Lovable, Bolt or v0 can go into the App Store and Google Play. Your web code runs inside the app, at its own local address, with access to native features through plugins.
That makes the web app's security problems the phone app's problems too, and adds a few of its own. Each check links to a short scenario and a prompt that checks your own project.
A dev server address left in the config
server.url makes the app load pages from your laptop. Testers away from your Wi-Fi get a blank screen.
Rejected as 'just a website'
Apple's Guideline 4.2 rejects apps that offer nothing beyond the website. Add real phone features and explain them.
Secret keys in the web bundle
VITE_ and NEXT_PUBLIC_ values are copied into the app's files, which anyone can unzip and read.
Database tables anyone can read
The app uses the same public key as your website. Row Level Security must protect every table.
Sign-in that never returns to the app
The app runs at capacitor://localhost on iOS and https://localhost on Android. Sign-in redirects must allow the app's address.
No way to delete an account in the app
Store rules require in-app account deletion for any app that lets people sign up.
A reviewer who can't sign in
Magic links and email codes don't reach reviewers. Provide a working review account.
API changes that break installed apps
Your website updates instantly; installed apps don't. Keep the API working for older versions.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.