Rork MVP hardening: earn the right to turn on paid traffic

The minimum is a tested primary journey, durable auth, ownership checks on every record, rate limits on expensive actions, server-side secrets, input and upload limits, backups with a restore check, and a rollbackable release. Add billing and consent validation if money or regulated data is involved. We rank the list by blast radius rather than by whichever screen looks unfinished.

Verify refresh and logout behavior across reinstall, device change, clock skew, and concurrent sessions. Bind authorization to the server-side owner, not a client-supplied identifier; rotate credentials without shipping them in the bundle; and redact tokens from logs and crash reports. Test expired sessions as a normal user would, including the point where a queued action resumes after re-authentication.

Instrument the funnel that paid traffic is buying: landing, signup, verification, first meaningful action, completion, and recovery. Pair event analytics with request IDs, structured errors, latency, job age, crash reports, and alerts that someone will actually acknowledge. A dashboard without a runbook is decoration, so every alert gets an owner, a threshold, and a next diagnostic step.

Missing privacy disclosures, undeclared tracking, broken account deletion, placeholder content, incorrect permission prompts, and a binary that cannot be reproduced are common late blockers. Apple and Google also expose weak offline handling, dead deep links, and review accounts that cannot reach the core flow. We test a clean install, upgrade, denial path, and reviewer account before submitting instead of treating approval as a final surprise.