Is That API Key Sitting Inside Your App? Rork Environment Variables vs. Supabase Edge Functions
Rork gives you two places to put an API key: its own environment variables, or a secret inside a Supabase Edge Function. Here is how I decide between them based on what I can revoke and who gets the bill, plus three checks to run after the key is in place.
There is no --json on eas env:list, so I rebuilt my environment variable inventory
eas env:list does not accept a --json flag. Here is how I turn --format short output into safe JSON, and how I spot a missing variable across three environments in one line.
EAS secret visibility does not keep a value out of your app — deciding prefix and visibility separately
The EXPO_PUBLIC_ prefix decides what ships inside your app; EAS visibility decides who can read it. Why stacking them blanks a value on OTA updates, and how to check your build.
Every Key You Ship Is Public: Secret Boundaries and Rotation for Rork-Generated Apps
Unzip your own .ipa, run strings, and your environment variables are right there in plain text. Here is how I sort keys into three tiers, move the dangerous ones behind an edge proxy, and keep a rotation runbook that assumes leakage.
Rork EAS Build Profile Switching Gone Wrong — Fixing development, preview, and production Pitfalls
Troubleshoot common EAS Build profile mistakes in Rork Max — environment variable misconfig, uploading development builds to TestFlight, hitting dev APIs in production, and more. Practical fixes for each symptom.
App Crashes After App Store Release But Not on TestFlight — 4 Common Causes
Your Rork app worked perfectly on TestFlight, but crashes after App Store release. Here are the 4 most common causes and how to fix each one.