Rork + Supabase
Monitor the Supabase backend of your Rork mobile app
A Rork app on Supabase carries the publishable key inside the iOS or Android binary, so anyone who unpacks the app can call your tables directly. RLS has to hold on every table. Connect your Supabase project, or a Rork Cloud backend after you transfer it to your Supabase organization, and Supahound scans RLS daily and flags cross-tenant reads and scraping.
Last updated
Rork has a built-in Supabase integration.
What are the Supabase security risks in Rork apps?
The publishable key ships in the app binary
Rork's manual setup has you paste the Supabase URL and publishable key into Rork, so the key ships in every copy of the mobile app. You cannot recall a binary from users' phones, so every table needs RLS from the first release.
Changes go live with no preview
Rork's docs say Rork Cloud changes are live immediately, with no preview step. A wrong policy or migration reaches production data the moment it runs.
Edge functions with private keys
Edge functions that hold private API keys or handle payment webhooks are reachable from the internet. Supabase lets anyone call a function deployed with verify_jwt = false, so each one needs its own caller check.
Same keys after a transfer
Transferring Rork Cloud to your own Supabase organization keeps the same URL, data and keys. Any key that leaked before the one-way transfer stays valid until you rotate it.
How does Supahound protect your Rork app?
- The free daily posture scan reports RLS coverage and newly exposed tables, which matters when a Rork Cloud change goes live without a preview.
- The cross-tenant read detector flags an app user whose reads cross into other users' rows.
- After 7 days of learning, the scraping detector flags someone who took the key from the binary and pages through your tables.
- The service-key detector flags a secret key used from a new network, for example after a transfer that kept old keys.
Frequently asked questions
- Can Supahound monitor Rork Cloud?
- Rork Cloud is in beta and hosted by Rork. Supahound watches projects in a Supabase organization you authorize. Rork lets you transfer Rork Cloud into your own Supabase organization with the same URL, data and keys; after that, connect it to Supahound.
- Does Rork write RLS policies?
- Rork Cloud's setup card says it creates the backend before adding tables, RLS policies or Edge Functions, and promises access rules so each user reads and writes only their own data. Rork documents no database security scan, so verify the policies yourself.
- Does Rork's AI App Store Reviewer check my database?
- No. It checks your app against App Store guidelines, not who can read your data. Test your RLS policies separately.
- Does the /hack-me scan work for a Rork app?
- Only for a website. The free /hack-me scan checks headers, TLS and Supabase keys in public JavaScript on a domain you prove you own. It does not open an iOS or Android binary, so it cannot see the key inside your Rork app.
Watch your Rork app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.