How do I turn an AI-generated prototype into a production mobile app?
A prototype becomes production when it clears five thresholds: (1) no hardcoded secrets, (2) authenticated data access with RLS, (3) restore purchases working, (4) crash + analytics instrumented, (5) a support channel a customer can reach.
Why it matters
Apple and Google review focus on exactly these five surfaces. AI code generators skip them by default because a prototype does not need them.
How to do it
-
Audit for secrets
grep for "sk-", "AIza", "AKIA", and any string that looks like a key. Move each to a server-side env var and route through a proxy.
-
Add real authentication
Supabase or Firebase Auth. Enable email verification. Add password reset. Add account deletion.
-
Turn on RLS or write rules
Every table gets a policy. Every rule gets tested with the emulator.
-
Wire restore purchases
Even if you only have one product, add restore. Apple requires it.
-
Add analytics and crash reporting
PostHog + Sentry, both free below a threshold. Wire them before submission so you see rejection-adjacent crashes.
-
Add a support channel
A working support URL, an in-app "Contact us" that sends a real email, or an intercom widget. Apple checks the URL.
Frequently asked
- Can I ship without RLS if my app is single-user?
- No app is really single-user — every install is a different user. Enable RLS anyway; it costs nothing and protects you from mistakes.
- Do I need all five before first submission?
- Yes. Missing any one is a common first-round rejection.