AI App Builder Audits · AI Development Series
Rork App Audit
Mobile changes the rules. Everything you ship is on somebody else's phone, and anyone determined enough can open it up and look.
What Rork actually hands you
Rork generates genuine cross-platform mobile applications using React Native and Expo, the same stack a professional mobile team would reach for. It is not a wrapper around a website, and the code is real and exportable.
What a Rork application is made of
- Framework React Native, via Expo
- Language JavaScript or TypeScript
- Platforms iOS, Android and web from one codebase
- Backend Whatever you connect, commonly Supabase or Firebase
- Updates Over-the-air updates through Expo
- Distribution Build and submit to the App Store and Google Play
The critical difference from a web application is where your code ends up. A website keeps its server code on your server. A mobile app is a file you hand to every user, and anyone can unpack it and read the JavaScript inside. There is no such thing as a secret in a mobile app bundle.
This changes what an audit prioritises. The question is no longer only "who can call this endpoint" but "what did we accidentally ship to a hundred thousand phones, and can we get it back". Over-the-air updates help with the second part, but only for code — a leaked key is leaked permanently.
What we consistently find
These are the issues specific to generated mobile applications.
API keys shipped inside the app
Generated code routinely puts service keys, database credentials and third-party API keys straight into the application, because that is the fastest way to make something work. On the web this would be bad. On mobile it is worse, because the app is distributed rather than served.
Anyone can download your app from the store, extract the bundle and read every string in it. Nothing you embed is private, no matter how it is named or where in the project it sits.
What it costs you: permanently leaked credentials, and bills run up on your accounts.Rules enforced only in the app
It is natural to put validation and permission logic in the application, since that is where the screens are. But the app is entirely under the user's control. It can be modified, and its network requests can be intercepted and changed.
If your server accepts whatever the app sends because the app is supposed to have checked it, then you have no validation at all — only a suggestion that honest users happen to follow.
What it costs you: anyone able to submit whatever they like directly to your backend.Data left sitting on the device
Mobile apps cache aggressively so they feel fast offline, and generated code tends to store more than it needs to, in ordinary unencrypted storage. Tokens, personal details and cached records all end up on the phone.
On a lost, stolen or shared device that is a real exposure, and it is the sort of thing that surfaces in a security questionnaire long after launch.
What it costs you: personal data recoverable from any device the app was installed on.No way to fix a bad release quickly
Web applications can be fixed in minutes. Mobile releases go through store review, and users have to install them. Expo's over-the-air updates soften this considerably, but only for JavaScript changes.
If nothing is monitoring for errors, you will not know a release is broken until reviews start appearing — and by then the damage to your rating is done.
What it costs you: a bad release visible to every user for days rather than minutes.Where Rork is genuinely good
Rork is a legitimate way to get a real mobile app built. React Native and Expo are what a professional team would use, it produces genuine cross-platform code, and it removes an enormous amount of the setup that makes mobile development painful to start.
Genuinely well suited to
- Getting a real mobile app in front of testers quickly
- Validating whether an idea needs an app at all
- Internal apps for a small, trusted group of staff
- Prototypes intended to be rebuilt properly if they work
- Founders who need something in the store to show people
Where it needs engineering behind it
- Apps handling personal data, health data or payments
- Anything where users could benefit from tampering with the app
- Multiple customers whose data must never mix
- Apps subject to security review by a client or partner
- Anything you intend to maintain across years of OS updates
The honest summary: Rork produces a real app on a real framework, and the code is fine as a starting point. What it cannot do is understand that a mobile app is a program you give away, which is the single assumption that determines whether the whole thing is safe.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- The app is live in the App Store or Google Play
- It stores personal data of any kind
- It takes payments or sits near anything that does
- It talks to a backend that trusts what the app sends it
- A client or partner has asked about your security
You are probably fine if
- It is only installed on your own device
- It holds nothing you would mind losing or leaking
- It is a prototype shared with a handful of testers
- It talks to nothing and stores nothing
Questions about auditing a Rork build
Yes, and it is not difficult. An app package is a file, and the JavaScript in a React Native app can be extracted and read with freely available tools. This is true of every app on every store, not just generated ones. It means anything embedded in the app should be treated as public, which is exactly why keys and permission logic have to live on a server instead.
No. Most of what we find can be fixed and shipped as an update, and Expo's over-the-air updates mean JavaScript changes can reach users without waiting for review. The exception is leaked credentials, which need rotating rather than patching, and the sooner that happens the better. If we find something urgent we tell you immediately rather than waiting for the report.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Rork expertise, it is that Rork produces React Native and Expo, which is ordinary mobile engineering.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Glide app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- What is actually inside the app bundle you ship to users
- What your backend will accept from a modified or intercepted client
- What the app stores on the device, and how
- Whether you would know if a release broke
We reply within one working day.
