Before You Ship: Go Looking for Your Own Keys Inside the Exported Expo Bundle
A key can be missing from your source and still be sitting inside the finished app. I ran expo export on Expo SDK 57, searched the bundle with grep and a short Node script, and recorded which secrets show up and which don't.
Every Key You Ship Is Public: Secret Boundaries and Rotation for Rork-Generated Apps
Unzip your own .ipa, run strings, and your environment variables are right there in plain text. Here is how I sort keys into three tiers, move the dangerous ones behind an edge proxy, and keep a rotation runbook that assumes leakage.
Before a Free Preview Walks Out via Screenshot: Detecting Screenshots and Screen Recording in Rork/Expo
How to protect paid preview images from screenshots and screen recording in a Rork/Expo app: the limits of expo-screen-capture, native isCaptured monitoring, and an iOS/Android-aware blur design.
Hardcoding Your OpenAI Key in a Rork (Expo) App Means It Gets Stolen — Slip a Thin Worker Proxy In Between
Embed an OpenAI or Gemini API key directly in the Expo app Rork generates and it can be extracted from the shipped binary. Here is why a key inside an app is never secret, plus a minimal Cloudflare Workers proxy that hides it (streaming passthrough included), simple abuse controls, and key rotation that needs no app review.
Where Should Your Rork App Store Auth Tokens? expo-secure-store and a Biometric Gate
How I moved a Rork-generated app's auth tokens out of AsyncStorage into expo-secure-store and put a biometric check in front of every read — including the size limit and sign-out gotchas I hit in production.
Auditing the Dependencies Rork Generates: A Supply-Chain Hygiene Routine
Even a four-screen Rork app pulls in 900+ transitive dependencies. Before a vulnerability lands and you cannot tell which app is affected, build an audit habit with npm ls, npm audit, overrides, and depcheck — framed for running several apps at once.
Protecting Your Rork App From Fraudulent Purchases and Request Spoofing — A Complete Server-Side Validation Design With App Attest and Play Integrity
A complete walkthrough of how to protect your Rork app's revenue and API endpoints from request spoofing and IAP fraud using Apple's App Attest and Google's Play Integrity APIs, with runnable Cloudflare Workers code and StoreKit 2 JWS verification.
Claude Mythos Preview: What App Developers Need to Know About the Future of AI
A look at Anthropic's Claude Mythos Preview and what its advanced coding, security, and reasoning capabilities mean for mobile app developers building with Rork.
How Claude Mythos Could Transform App Development: Security, Agents, and What's Next
An honest look at what Claude Mythos means for app developers: autonomous vulnerability discovery, long-horizon coding agents, and how to think about integrating Mythos-class capabilities into mobile development workflows.
Rork Max × Automated AI Code Review: Continuous Quality Assurance with GitHub Actions + Claude API
Automate AI code review for Rork Max with GitHub Actions and Claude API. Detect bugs, security risks, and performance issues on every PR automatically.
Complete Security Implementation Guide for Rork Apps — Biometrics, Encryption, Secure Storage & Certificate Pinning
Harden your Rork app for production: biometric auth, AES encryption, secure storage, certificate pinning, jailbreak detection, and ATT — with working code.
Rork Max × Supabase Edge Functions & Row Level Security — Complete Secure API Design Guide
Learn how to design and implement secure, scalable APIs for Rork Max apps using Supabase Edge Functions and Row Level Security (RLS). From authorization patterns to production deployment.