Launch Readiness Audit · sample
Redline 1.0 (12)
Expo SDK 54 · Supabase · RevenueCat · built with Rork
| severity | finding | cause | fix |
|---|---|---|---|
| Critical | OpenAI key readable inside the .ipa | EXPO_PUBLIC_OPENAI_KEY compiled into the client | Edge function, rotate key |
| Critical | Any user can read every workout | RLS disabled on 4 of 6 Supabase tables | Per-user policies |
| High | Restore Purchases does nothing | Shows an alert; never calls RevenueCat | restorePurchases + entitlement |
| High | Crash on launch in release build | API_URL undefined in EAS environment | EAS env, release test |
| Medium | Google sign-in loops | redline:// not in allowed redirect URLs | Register scheme |
| Medium | No in-app account deletion | Required by 5.1.1(v) | Delete flow + backend |
| Low | iPad screenshots stretched | Guideline 2.3 | Regenerate set |
Verdict Fix, don't rebuild. Targeted Fix + one resubmission.
p. 1 of 14