Fixing a Rork app: what breaks between the preview and the App Store

First: which kind of Rork app is it?

Rork changed what it generates. Its docs now say: “You can no longer create Expo (React Native) projects in Rork. New apps are native iPhone (Swift), native Android (Kotlin), or web.” Existing Expo projects keep working and can still be built, published and synced to GitHub.

If your project was created as an Expo app, everything below applies directly, and it’s the work we do. Rork’s newer native apps share many of the same problems, since secrets, paywalls, sign-in and review rules don’t depend on the framework, but the fixes are written in Swift or Kotlin instead.

What breaks, from Rork’s own documentation

Secrets and keys

Rork’s docs warn that variables prefixed EXPO_PUBLIC_ are “shipped inside the app, readable by anyone who installs it,” and say: “Never give a secret key an EXPO_PUBLIC_ name.” An AI or payment key with that prefix is readable by anyone with the app. Move it into a server function and rotate it, because the old key has already shipped.

Two more details catch people when they leave the preview. Secrets “are not committed” to GitHub, so they must be set again wherever the code runs. And values are baked in at build time, so changing one “needs a new build.” Our guide to crashes on launch in TestFlight covers the Expo version of this in detail.

Crashes and build failures

Rork’s submission-errors page lists problems that stop an upload or a build: a missing Info.plist permission key, a capability not enabled on the Apple account, bundle ID or version mismatches. It also lists two TestFlight symptoms: the app “will instantly crash once you open it” and “the AI functionality will not work.” Both usually trace back to configuration the preview supplied and the real build didn’t have.

Features the preview can’t run

The cloud simulator Rork uses for previews has no camera and can’t receive Apple push notifications. Anything built on those needs testing on a real device before it goes to review.

Paywalls

Rork’s RevenueCat guide notes that Test Store purchases are not real in-app purchases: a TestFlight build is required for real Apple IAP. The common failures it lists are agreements and banking not being active in App Store Connect, and the App Store public API key not being set properly. Our Restore Purchases guide covers the restore button reviewers test and the store settings behind an empty paywall.

Sign in with Apple

Rork’s OAuth docs list review traps: asking for the name or email again after Apple sign-in, rejecting @privaterelay.appleid.com addresses, and making the Apple button less prominent than Google’s. They also warn that switching auth systems later forces users to sign up again, so choose before launch.

Rejections Rork warns about

Its review checklist names vague permission strings, subscription apps missing a privacy policy, terms and EULA in the listing and on the paywall, a hard paywall not disclosed in the description, and stretched iPhone screenshots used for iPad. If the app sends data to an AI model, add guideline 5.1.2(i) to that list, and if it has sign-up, account deletion under 5.1.1(v).

About the 2026 “vibe coding” App Store crackdown

In March 2026 Apple blocked updates to several builder apps under guideline 2.5.2, which says apps may not “download, install, or execute code which introduces or changes features or functionality of the app, including other apps.” The coverage Michael Tsai collected names builder apps such as Replit, Vibecode and Anything. It was about apps that run generated code inside themselves, not the apps people build with them. We found no reports of Rork-built apps being rejected under 2.5.2.

Taking the code out of Rork

On paid plans Rork syncs the project to GitHub in both directions, so you can open it in Cursor, Claude Code or your own editor and import changes back. Expect to set secrets again locally. Features built on Rork’s own services, such as Rork Auth or its AI cloud, keep depending on Rork unless you replace them.

How we handle it

We start from the GitHub export, build the app the way the stores will, and test on real devices. Then we fix the gap between the preview and production: keys moved to a server, variables set where the build runs, purchases and restore tested with sandbox accounts, sign-in checked against the review rules. We write down what changed so the next prompt in Rork doesn’t quietly undo it.