Ship It Checklist

Checklists /Ship to the App Store /Secrets and backend

Critical

Keep service-role and admin keys out of the binary

An iOS binary can be unpacked. A Supabase service-role key, a database password, or an admin token inside the app is then public. The app should ship only keys that are safe for a client, such as a Supabase anon key, and the server should enforce access.

How to check

  1. Search the project for service_role, SERVICE_ROLE, sk_live, and private_key.
  2. Open the iOS release build output and search the JavaScript bundle or the app strings for those same names.
  3. Environment values prefixed for the client (EXPO_PUBLIC_, and anything embedded by a FlutterFlow or Capacitor build) count as public.
  4. Confirm the client uses the anon or publishable key only.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this iOS project. Do not add features.

Goal: No service-role, secret, or admin key is compiled into the iOS app.

The project may be Expo, React Native, Swift, a Capacitor wrapper, or a FlutterFlow export. Change only files that already exist.

Steps:
1. Search for service_role, secret keys, and client-exposed env prefixes.
2. Move any privileged call to a server you control. The app should send the user's own session, not an admin key.
3. If a real key was in the repo or the bundle, tell me which key to rotate. Do not print the value.
4. Do not print certificates, private keys, API keys, or App Store Connect passwords.
5. Tell me which files you changed, and list anything I still have to do in Xcode or App Store Connect.

This uses the same ticks as the checklist page, saved in this browser.