Harden a Rork MVP before paid traffic (2026)

Harden a Rork MVP before paid traffic by treating the cloud simulator as the lab and one advertised origin — the TestFlight or Play internal binary you already rehearsed, or the one rork.app host you actually share — as the only stranger door. Keep Stripe and service keys Server-side only, never EXPO_PUBLIC_. Pick one auth model. Prove row rules on a real device. Name Unpublish or a store halt. Then buy ads.

This note is from CodeCross, an Austin, Texas app development company (Pakistan engineering on a US Central overlap). Other tools sit on vibe coding. Buying help is the Austin app development company page. If nobody can name Unpublish or a store halt tonight, book a conversation.

Money leaves when the campaign still lists a simulator screenshot, a Stripe secret named `EXPO_PUBLIC_`, or a Cloud row anyone can read. Plans put Free at $0 for design only, Pro at $20 a month for 100 build credits, and Max from $200. That fee buys Build mode, GitHub export, and store upload. It does not buy a sealed Secrets panel. Build credits vs Cloud credits are two balances. Chat turns burn build credits. A stranger hitting an in-app AI feature burns Cloud credits you pay in dollars. A Chat turn to “fix the leak” still burns *your* build credits.

This essay is the week before you buy ads, while the binary still comes from Rork. Close the risky doors while the host still writes the tree. It expands Rork MVP hardening. This page is not Rork to production, get off Rork, migrate from Rork, or transition from Rork. It is also not transition from Rork to a shippable mobile app — that essay is the exit sequence: take the repo, pick Cloud versus yours, then leave. The question here is narrower: can you buy a click while Rork still owns Publish, TestFlight, and the Cloud rows? When secrets, Unpublish, or the advertised origin is still open, book.

Stay on Rork. Close the doors first.

Rork is paid to finish a native app tonight. Paid traffic is paid to send strangers at a public binary or a public web address. Those jobs collide. A green cloud simulator can still leave a service key on the phone, a Cloud table with no owner rule, or a leftover `rork.app` name as the share link.

The vendor’s own docs draw the line. Publish your app is blunt: Rork builds and uploads on its machines. You do not need Xcode or Android Studio. What Rork cannot do is be you. Apple wants a $99-a-year Developer account. Google wants a $25 Play account, identity checks, and — for new personal accounts — a closed test with 12 testers for 14 days. Switching the preview from iPhone to Android does not close a row. You still pick who may read a Cloud record. You still pick which origin ads will hit.

Rork Web is the fast door. Publish to web hosts the site at an address like `ember-roast-website.rork.app`. A custom domain attaches only after that first publish. Unpublish takes every address on that site down after a confirm. You do not need a new builder this week. You do need to name who holds Secrets, who can press Publish, and which URL or store listing ads will hit.

Fix the worst risk first. Ads turn a small leak into a big one.

Start with the worst risk, not a prettier home screen. A stranger who dumps every order row, burns Cloud credits from a public AI feature, or copies a live Stripe secret from the binary will cost more than a new onboarding flow. Put those risks in order, worst first. Close the worst one tonight.

Put six names on paper: who owns Secrets, who proves login on a real device, who can press Publish, who watches Cloud credits after a launch, who owns the public origin, and who can Unpublish or halt a store build tonight. Two red names plus a campaign date means spend stays off. If you cannot name a human for each layer, book.

The simulator is the lab. The store binary or rork.app host is the ad target.

Rork gives you several surfaces that look live. They are not the same job.

TestFlight uploads the iPhone build for you. Rork then offers Share Beta Link — an address like `rork.com/beta/…`. You can copy it, regenerate it if it leaked, and revoke it when testing is over. A TestFlight build is not for sale and not public. Apple’s TestFlight page is the channel. Do not treat a beta invite as a campaign asset.

Play developer account says Rork’s automated upload lands in internal testing. “Version 1 is in internal testing. It isn’t public yet.” Promoting to production is a Play Console decision. New personal accounts created after 13 November 2023 need a closed test with 12 testers opted in for 14 days. Internal testing does not satisfy that rule. Start the account on day one.

Google Ads destination mismatch rejects an ad when the display URL domain does not match the final URL. Do not advertise your custom domain if clicks still land on a leftover `rork.app` slug. Do not advertise the App Store if the creative still opens a simulator recording. Point ads, mail, and in-app shares at one name you proved.

Secrets: EXPO_PUBLIC_ is the phone. Everything else stays on the server.

Keys are the next thing ads will leak. API keys and environment variables keep values in More → Secrets, not in chat and not in code. A name that starts with `EXPO_PUBLIC_` is baked into the app at build time. Everything else is Server-side only. The editor repeats the rule: prefix to make a variable available on the client. Never give a Stripe secret or a service-role key that prefix.

Rork’s own examples are the split. `EXPO_PUBLIC_SUPABASE_URL` is an address. Database rules protect it. `STRIPE_SECRET_KEY` must stay Server-side only. It can move money. If a feature needs a private key, ask for a server function. If a live secret sat in chat, in a Swift file, or under an `EXPO_PUBLIC_` name, rotate it at the provider first, then update Secrets, then ship a new build. A native value is baked in. Reloading the preview is not enough.

Secrets do not go to GitHub. They live with the project. Set them again in any environment you run yourself. Share a project is the seat table: Owner and Editor can read and edit keys. Viewer sees the panel and cannot edit. A cloned project copies your variables except the keys Rork manages. Invite Editors as if they can empty the Stripe account — because they can read the value. If the only place the secret still lives is a prompt history you will not search, book.

Auth and rows: one model. A hide in the preview is not the lock.

Rows and money paths are the first thing ads will leak. Rork is good at drawing a checkout in chat. It is weaker at naming who may read the row after that checkout. Add accounts gives you two models. Rork Auth is Google and Apple with no extra console and no backend. Supabase Auth is email, magic links, and phone codes — and it needs a Supabase project. One project uses one of them, never both. Each hands out its own user ID. Mix them and people sign in to empty screens. Accounts do not move if you switch later.

Rules name the person differently. Rork Auth policies use `user_id()`. Supabase policies use `auth.uid()`. A hidden button is not a policy. OWASP Top 10 2025 still ranks broken access control first. They found some form of it in 100% of apps they tested. One example is an admin check that lives only in the front end. A preview hide is that example.

Rork Auth sessions last one hour and refresh quietly. They live in the Keychain on Swift, SecureStore on leftover Expo, and `localStorage` on web. The session survives delete-and-reinstall. Test sign-out as a product feature. Apple will reject Sign in with Apple mistakes Rork itself lists: asking again for name and email; refusing `@privaterelay.appleid.com` addresses; hiding the Apple button. Those are App Store Review Guidelines problems, not prompt problems. Run them on a real device before you buy a click that lands there.

Prove the function, not the screen. Call the route logged out. You want a refusal, not a row. Then call it as user B against user A’s order. You want a refusal again. A green simulator as the founder is not that proof. Never put `service_role` in client code — it bypasses RLS entirely.

Rork Cloud is live. There is no preview database.

Rork Cloud is a hosted Postgres with RLS and Edge Functions, still in beta and free to run. The agent shows Create Rork Cloud before it adds tables. Connect my Supabase is the same card’s other path. Changes are live right away. There is no separate preview step. A delete you asked for in chat is a delete in the live store. Be careful the week ads go live.

Transfer to your own Supabase sits at the top of the Database tab. The whole backend moves. URL, data, and keys stay the same, so the published app keeps working. The transfer is one-way. Billing moves to you. This page does not make you transfer. It asks you to name who can open Database, who can press Transfer, and whether a stranger can already read a row. If you cannot restore a copy you can see, spend stays off.

Cancel does not delete data. Rork says the app and its backend keep running if the subscription ends. That sentence is a trap if you read it as “ads are free to leave open.” Cloud credits still bill. A public mutating function still writes. Owned compute — a GitHub tree that builds with the Rork tab closed — is how you know you *could* leave. It is not how you take a live binary offline. That is Unpublish, a revoked beta link, or a store halt.

Build credits pay the agent. Cloud credits pay the stranger.

Build credits vs Cloud credits are separate tabs. Build credits cover chat, previews, asset generation, and publishing. They come with the plan. Cloud credits are a dollar balance. Rork gives $1 to start. After that you add $5 to $200. Backend functions, in-app chat, images, voice, and web search draw from that balance when *users* hit them. Auto top-up can charge a saved card. A monthly spending limit stops those top-ups. Name the limit before ads.

On-device Apple Foundation Models on a supported iPhone do not burn Cloud credits. They also do not run on every device your campaign will hit. A fallback to Rork AI Cloud is a bill. Cap two meters the week ads go live. First: who may send chat (Editors spend the owner’s build credits). Second: which Cloud features a stranger can exercise. A public AI route is not a Rork plan problem. It is your dollar balance.

Who may Publish, and who can read Secrets.

Share a project has two roles. Editor can chat, edit code, edit Secrets, Publish, submit to the stores, and invite others. Viewer can read the chat and the preview and leave comments. Viewer cannot send a message. Collaborators spend the project owner’s credits. Invite links last a year. Email invites expire in seven days. Every Rork project is private — a stranger with the project URL gets nothing — until you Publish. Publishing a web app does not expose the chat. It does expose the origin you just advertised.

Only the person who created the project can connect a custom domain. Collaborators see the panel and a note that says so. Clone copies code, chat, assets, and most variables into a new owner’s project. A published web address stays with the original. Do not treat a clone invite as a campaign asset. Name the humans who may press Publish to web, Submit to App Store, and Upload to Google Play. An Editor with Secrets access and a Publish button is a blast radius, not a convenience.

GitHub: a cold boot is proof. It is not the off switch.

Default rows and the live binary still live with Rork until you prove a tree you can start without the editor. Code export is paid: paid users own generated code and download it through GitHub. GitHub sync is two-way. Share the repo. Open it in Cursor or Xcode. Keep building in Rork in parallel if you want. Read the code is free. Hand-editing is not. iPhone-plus-Android is two codebases in one project: Swift and Kotlin.

A green push is a backup. It is not Unpublish. It is not a store halt. Secrets never land in Git. Cloud rows are not in Git. Store certificates are not in Git. Prove the cold boot once: editor closed, clone opened, placeholders replaced, primary journey completes. Then you know you *could* leave. This page does not make you leave. New work is Swift and Kotlin. Existing Expo projects keep working. Do not invent a rewrite because the homepage changed.

Off switch: Unpublish, revoke, or halt. Not Revert.

A bad launch needs an off switch you can name tonight. Asking chat to “fix it” waits on a prompt and burns build credits. That is repair. It is not an off switch.

Rork Web names the web switch. After the first publish the panel reads Live and Unpublish takes the site down. Every address on that site stops serving it right away. Unpublish asks you to confirm. Name the person who can open Publish. Hit Unpublish once in a safe window so you know the control works. Then turn it back on. Undo and history is a different drawer. Undo rolls the last chat answer. Revert puts the project back to an earlier answer and trims later messages. Revert does not undo a publish. Your live web app or your submitted build stays as it is until you publish again. Environment variables are not part of the code version. Check Secrets after a revert.

For a store binary the halt lives in the store, not in chat. Revoke the `rork.com/beta/…` link if testers should stop installing. Expire or stop the TestFlight build in App Store Connect. Halt or unpublish the Play track you used. A Revert you have never clicked is folklore. A Chat turn that says “undo the upload” is not Danger Zone.

Watching: the primary journey after a bad launch.

Watching without an off switch is half a lock. Before ads, name three signals: sign-in failures on the advertised origin, the primary money or lead path after Publish, and Cloud-credit plus connector spend. Code view Logs are the lab. They are not the stranger meter. Name who watches the advertised URL or store listing the first day ads run.

A green simulator can look fine and then miss a Cloud rule that went live the moment you asked for it. Remember the split: no preview database. If the campaign lands on empty screens because the rules still call `auth.uid()` on a Rork Auth project, that is a watch miss, not a creative miss. Prove the advertised origin on a cold install, signed out, then as a fresh account, before you buy a click that lands there.

Score each row against the advertised origin, not the simulator. One red cell — a mutating route without an owner rule, a key in chat, a simulator ad, an Editor treated as a lock, a repo you have never booted, or an Unpublish you have never hit — is enough to hold the spend. Move that cell. Do not greenwash the matrix.

The week before you buy ads

Treat the next seven days as operator time on the Rork project, not a slogan. Inventory who can Publish, who holds Secrets, and which origin ads will hit. Then seal. Then prove.

Day 0 is inventory. Write five facts. The public origin. The person who can Publish. Whether a live key still sits in chat or under `EXPO_PUBLIC_`. Whether a stranger can call a mutating Cloud function. Whether you can Unpublish or halt tonight. If the public origin is already taking leads and you cannot name those five, stop. You do not need a new screen. You need this list.

Seal rows first. Then Secrets. Then the origin. Bots do not wait for a nicer paywall. If a public payment path exists, prove it refuses the call when the stranger is logged out. Then strip leftover simulator shares. Then Unpublish once in a safe window so you know the off switch works. Then spend. This page is the week you run that list.

Treat those bars as calendar you reserve, not a vendor promise. If you cannot name the advertised origin, who can Publish, and who can Unpublish, the later days will thrash. The long bar is the expensive miss: a “small” test while a Cloud row or a chat secret is still the company.

Stay on Rork, or leave. Do not mix the two jobs.

Pick one job for this week. Stay keeps Rork as the studio, with sealed rows, Secrets filled, a store binary or rork.app host as the origin, and Unpublish already proved. Leave opens the transition essay and stops buying clicks that need this Publish window.

If you only need a leave date, use when to leave an AI builder. A door that will not close belongs on rewrite vs harden. A personal Git remote belongs on GitHub handoff. A host-only ship path belongs on CI/CD after an AI builder. The exit cousin is transition from Rork to a shippable mobile app. Cousin wraps: Rocket.new, FlutterFlow, Create.xyz. Those pages are not this Rork week.

When the list turns red

Leave the product up. Kill the campaign if any of these are still true:

• A money or personal-data row is still readable logged out, or a stranger can read another user’s record.
• A live key still exists in chat, in client code, or under an `EXPO_PUBLIC_` name.
• Ads, mail, or Auth still list the simulator, localhost, or a leftover `rork.app` name you do not mean to keep.
• The only restore is “we will Revert,” and you have never cold-booted the repo with the editor closed.
• The off switch is another Chat turn, or you have never hit Unpublish (and you are still on Free, so you cannot Build).
• Two people disagree about who can Publish or who holds Secrets.

A single red door is a miss, even if the simulator is green. Stop adding screens until rows, Secrets, the origin, and Unpublish are honest. Finish those doors. Then spend — or open the transition essay if the host is still the company.

Bring a second pair of hands when the founder cannot rotate a key without pasting it back into chat, when a stranger can still read a Cloud row, or when nobody has hit Unpublish before the date. Hire for owner rules, Secrets, Publish seats, and the origin map — not a prettier home screen. Austin app development company is the studio brief. Austin mobile app development if the next door is a store binary that still depends on this Rork Publish.

Next steps

Walk the gates in order. Inventory the public origin, the person who can Publish, and who holds Secrets. Drain chat into the Secrets panel. Rotate anything that appeared there. Require one auth model and an owner on money and personal-data rows. Prove a stranger test on a real device. Cold-boot the GitHub export with the editor closed. Hit Unpublish or revoke a beta link once. Then buy the click — or open the exit if the process itself must leave Rork.

CodeCross LLC is an Austin-registered product studio (1606 Headway Cir STE 9212, Austin, TX). The Rork week we run is sealed rows, Secrets filled, a Publish origin you own, a repo you have already started, then Unpublish you have already hit. The Austin app development company page is the studio brief. Austin mobile app development is the store-binary door if strangers still hit this Rork host. Company-level evidence lives on proof. When the off switch, secrets, or the advertised origin is still open, book a conversation.

Rork is allowed to stay the studio. Ads are not allowed to treat a green simulator, an open Cloud row, or an unreviewed chat secret as that proof. Show Unpublish you can hit, rows that refuse a stranger who is not the owner, and keys that never lived in chat. Most teams never need a second codebase once those three exist.

FAQ

What breaks first when paid clicks hit a Rork app that never left the simulator?

Rows and keys, not the home screen. Rork Cloud has no preview database — a rule you asked for is already live. A stranger who can read another user’s order, or an `EXPO_PUBLIC_` Stripe secret baked into the IPA, costs more than a missed conversion. Prove the money path signed out, then as a second account, on a real device. The simulator is the lab.

Who can press Publish and still read the project’s Secrets?

An Editor. Share a project lets Editors chat, edit code, edit Secrets, Publish, and submit to the stores. Viewers cannot. Secrets says Owner and Editor can read keys. Collaborators spend the owner’s build credits. Name who may Publish before you buy a click. A year-long invite link is a door, not a courtesy.

When is it safe to buy ads against a TestFlight build or a Play internal track?

After a stranger test on that binary, not after a green simulator. TestFlight is not for sale and not public. Play lands Rork uploads in internal testing; production is your Console decision. New personal Play accounts still need 12 testers for 14 days. If ads will open the store listing, the listing must match the binary you proved.

Which switch takes a published rork.app site down tonight?

Rork Web Unpublish. After the first publish the panel reads Live. Unpublish confirms, then every address on that site stops. Undo and history Revert restores files in the editor. It does not take the live site down. A store binary needs a revoked beta link or a halt in App Store Connect or Play Console.

What still lives in Rork after a paid GitHub export?

Secrets, Cloud rows, and store seats. Code export gives paid users the generated tree through GitHub sync. Secrets do not go to GitHub. Cloud data needs the Database tab or a one-way transfer. Apple and Google accounts stay in those consoles. A clone you have never booted is not an off switch.

How do you prove a stranger cannot read another user’s Cloud row?

Call the API as user B against user A’s record, on a device that is not the author’s. Add accounts says Rork Auth rules use `user_id()` and Supabase Auth rules use `auth.uid()`. One project uses one model. A hide in the preview is paint. If the row returns, spend stays off — even if the simulator still looks fine.