Rork security checklist
Rork builds phone apps from a chat: Rork Pro makes React Native apps with Expo for iOS and Android, and Rork Max makes native iOS apps in SwiftUI. Either way, the app file ends up on people's phones, where anyone can open it, and old versions keep running for months.
These are the checks AI-built mobile apps miss most, from leaked keys to App Store rejections. Each links to a short scenario showing the failure, and the prompt that checks your own project.
Secret keys inside the app
Anything built into the app can be read by anyone who downloads it. Paid API keys belong on a server.
Backend tables anyone can read
If the app talks to a database directly, the database's own rules must limit each user to their rows.
No way to delete an account in the app
Apple and Google require in-app account deletion for apps that create accounts.
A reviewer who can't sign in
Email codes and magic links never reach the reviewer. Give them a working review account.
Server changes that break old versions
People keep old versions for months. Add fields; don't rename them while old apps still read them.
Sign-in links that open the website
If the app's return address isn't on the allowed list, sign-in quietly falls back to the website.
Updates that need a new store build
Over-the-air updates change JavaScript only. New native packages need a store build.
AI features anyone can call
An AI endpoint without sign-in and limits turns into someone else's free AI, on your bill.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.