HOW TO SECURE A RORK APP

Rork Security Context

Rork generates cross-platform mobile apps — React Native + Expo — from natural-language prompts, previewable on device and publishable toward the app stores. The backend is typically a hosted service the generator wires up for you, most commonly Supabase or Firebase. That architecture has one security consequence that dominates everything else: the client binary is public. Every string in the bundle can be extracted from the APK or IPA, so the real auth boundary is the backend’s security rules (Supabase RLS, Firestore rules), never the app code. The recurring shape we see is “the app checks the user’s role, the backend checks nothing, and anyone with the extracted API endpoint reads the whole table.”

Security Checklist

1. Treat every key in the bundle as public

Anything Rork puts in the app — API URLs, anon keys, third-party tokens — ships in the APK/IPA and is extractable with free tooling. The Supabase anon key and Firebase config are designed to ship, but only when backend rules enforce access. Any other secret (service keys, payment secrets, LLM API keys) must live server-side. Run the Token Leak Checker shape of audit against your own bundle before release.

2. Enable RLS on every Supabase table

If Rork wired you to Supabase: the anon key in the bundle is fine ONLY if Row Level Security is enabled on every table with a policy that scopes rows to auth.uid(). One table without RLS is fully readable and writable with the shipped key. Verify with the Supabase RLS Checker — this is the single highest-impact check for a Rork + Supabase app.

3. Lock down Firestore rules if Firebase is the backend

Firebase projects generated in a hurry frequently run in test mode (allow read, write: if true) or gate only on request.auth != null, which means any signed-in user reads everyone’s data. Scope rules to request.auth.uid == resource.data.owner_id per collection. The Firebase Scanner probes for the open-rules shape from outside.

4. Move tokens from AsyncStorage to SecureStore

Generated auth flows often persist session tokens in AsyncStorage, which is unencrypted on both platforms and readable on rooted/jailbroken devices and from some backup paths. Use expo-secure-store (Keychain on iOS, Keystore on Android) for anything session- or credential-shaped. Grep the generated code for AsyncStorage.setItem calls carrying tokens.

5. Verify purchases server-side

Client-side-only checks for premium features are the classic vibe-coded mobile bug: if (user.isPremium) in React Native is a boolean an attacker flips in a patched binary. In-app purchase receipts must be verified server-side against Apple/Google before the backend grants entitlements — the entitlement flag lives in the database, gated by rules, not in app state.

6. Assume no certificate pinning

Rork apps don’t ship certificate pinning by default. For most apps that’s acceptable — TLS plus correct backend rules carries the load. If you handle high-value data, add pinning deliberately and plan for certificate rotation; a botched pin bricks the app until users update.

7. Validate deep link parameters

Generated deep link handlers tend to accept whatever arrives: myapp://reset-password?token=...&redirect=... with no validation. Treat deep link params as hostile input — validate types, allowlist redirect targets, and never make an auth decision from a deep link param alone.

8. Authenticate every generated API route

If Rork generated a custom API layer (Edge Functions, Cloud Functions, or a small server), audit every route for an auth check. Generated CRUD is routinely missing both authentication and ownership checks — the BOLA in AI-generated CRUD pattern in its purest form.

9. Test for BOLA with two accounts

Sign up as user A on one device or simulator, create a record, note its ID. Sign in as user B and request that ID — through the app and directly against the API with the extracted endpoint. If B gets A’s data, your rules scope to “any authenticated user” instead of “owner.”

10. Strip role fields from client writes

If the users table or collection has a role, is_premium, or is_admin field and the client can write its own profile row, a patched client can self-promote. Column-level restrictions (Supabase) or rule conditions rejecting writes to privileged fields (Firestore) close it.

11. Rate-limit expensive endpoints

Any backend call that costs money — LLM calls, image generation, SMS — needs per-user and per-IP limits enforced server-side. The mobile app can’t enforce this; a script replaying the extracted API calls bypasses the app entirely.

12. Handle errors without leaking internals

Generated backends return raw error objects — SQL fragments, stack traces, internal paths — straight to the client. Return generic messages; log details server-side.

13. Plan for the update lag

Mobile’s critical difference from web: you cannot rotate a shipped app instantly. A secret leaked in a released binary stays leaked until every user updates, and app store review adds days. This is why secrets must be server-side from day one — there is no fast rollback for a bundle. If a real secret ever shipped, rotate it server-side immediately and treat the shipped copy as burned.

14. Re-audit after every regeneration

Prompting Rork to change a feature can regenerate auth flows, storage calls, and API wiring. After each significant regeneration, re-check: token storage, backend rules still matching the schema, no new hardcoded keys, deep link handlers unchanged.

15. Run a security scan

The Vibe Code Scanner covers the deploy-side patterns for your backend; the full VibeEval scan adds BOLA, role-escalation, and open-rules probes against the API your app actually calls.

Common Vulnerabilities in Rork Apps

Anon Key Shipped Without RLS

The Supabase anon key in the bundle is safe by design — until one table lacks RLS. Then the shipped key is a full read/write credential for that table, extractable by anyone with the APK.

Client-Side Entitlement Checks

Premium gating implemented as React Native conditionals. A patched binary or a replayed API call gets the premium behavior free. Entitlements belong in the backend, verified against store receipts.

Tokens in AsyncStorage

Session tokens in plaintext storage instead of Keychain/Keystore. Fine in a demo, an account-takeover vector on a compromised device.

Unvalidated Deep Links

Deep link handlers that trust their parameters — attacker-crafted links that redirect auth flows or inject state into the app.

Related Resources

Free Self-Audit Suite

Five free scanners.

Supabase RLS Checker

The must-run check for Rork + Supabase apps.

Firebase Scanner

Open-rules probe for Rork + Firebase apps.

Automate Your Security Checks

VibeEval scans the backend your Rork application talks to against every category above, plus the full probe set. Findings ship with fix prompts you can paste back into the Rork chat for one-shot remediation.