# Expo pre-launch checklist

From BuildThenTested (https://buildthentested.com/stack/expo/). 15 checks in the order we run them, most severe first. Each check links to a page with what it looks like, a self-check and a fix direction.

Defaults referenced are from Expo's documentation, verified 2026-09-21. Tick a box only after you have seen the result yourself.

## Secrets and keys

- [ ] **Secrets committed to the code repository** (critical). Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  https://buildthentested.com/patterns/secrets-committed-to-repo/

## Data access

- [ ] **Record ids accepted without an ownership check** (critical). Create two accounts in your app and add one record, such as an order or a note, in each.
  https://buildthentested.com/patterns/idor-on-record-ids/

## Login and permissions

- [ ] **Authorization enforced only in the browser** (critical). Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
  https://buildthentested.com/patterns/authorization-only-in-browser/

## AI features

- [ ] **LLM API key exposed to the client** (critical). Open your live app, press F12, select the Network tab, and use the AI feature once.
  https://buildthentested.com/patterns/llm-api-key-exposed-to-client/

## Mobile

- [ ] **Secrets in the mobile app bundle** (critical). Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.
  https://buildthentested.com/patterns/secrets-in-mobile-app-bundle/

## Secrets and keys

- [ ] **Third-party API key in the JavaScript bundle** (high). Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
  https://buildthentested.com/patterns/api-key-in-javascript-bundle/

## Payments

- [ ] **Subscription state trusted from local storage** (high). Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
  https://buildthentested.com/patterns/subscription-state-trusted-from-local-storage/

## Reliability

- [ ] **No rate limiting on sensitive routes** (high). Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
  https://buildthentested.com/patterns/no-rate-limiting/

## Deploy and config

- [ ] **Dependencies with known vulnerabilities** (high). If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
  https://buildthentested.com/patterns/dependencies-with-known-vulnerabilities/

## Mobile

- [ ] **Offline state corrupting data** (high). On two phones (or a phone and the simulator) signed into the same account, put one in airplane mode and edit the same record on both.
  https://buildthentested.com/patterns/offline-state-corrupting-data/

## Reliability

- [ ] **Errors swallowed, spinner never stops** (medium). Open your app in Chrome and sign in as a normal user.
  https://buildthentested.com/patterns/errors-swallowed-ui-spins-forever/

- [ ] **Retries with no pause and no cap** (medium). Open your app in Chrome, press F12 and choose the Network tab.
  https://buildthentested.com/patterns/retries-without-backoff/

## Performance

- [ ] **List endpoints that return everything** (medium). Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  https://buildthentested.com/patterns/unpaginated-list-endpoints/

- [ ] **Whole table downloaded, filtered in the browser** (medium). Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  https://buildthentested.com/patterns/whole-table-fetch-then-client-filter/

## Mobile

- [ ] **Certificate pinning absent** (medium). Search the project for pinning-related words: pin, sha256, certificate, network_security_config, NSPinnedDomains, trustkit.
  https://buildthentested.com/patterns/certificate-pinning-absent/

---

We test against a defined checklist and report what we find. We do not guarantee that an app is free of vulnerabilities. We are not a certified penetration-testing firm and do not issue compliance attestations. We do not rebuild your app; fixes are yours or your developer's, and we re-check them.

Questions: hello@buildthentested.com