RapidNative test data

The Fitting Room brief was pasted word for word (1,693 characters) into the prompt box on RapidNative's dashboard, in Build mode, on the Free plan. The first click was held by a Terms and Conditions box; the brief went through after the owner of the account accepted the terms, at about 00:25 UTC on 28 October 2026.

RapidNative asked no questions. By 00:32 UTC it showed a plan of nine tasks and a balance of 9.99 credits. I pressed Start building at 00:33, and at 00:45 the builder said the free credits for the day were used up. Six of the nine tasks were marked done. It had made nine screens: home, timetable, class, My bookings and Buy a pass, plus sign-up, log-in, forgot password and reset password. The first task alone took about 3 credits. The builder said the instructor and Ask the studio screens could not be added because the Free plan allows five screens.

• The brief was submitted a few minutes before the first poll, so the time to the plan is read from the project card, which said seven minutes at 00:32 UTC.

I booked and cancelled classes and bought passes as four accounts, read the records back through the app and through the builder's Live Data panel, and reloaded and signed in again.

Bookings and orders were written and were still there after reloads and after signing in as another user. The Live Data panel is a table editor with a filter box, an Insert button, a column menu and Export as CSV or JSON. It says: 'Live Data is the database behind the live player preview and the app you open by scanning the QR. Its data is disposable and refreshes when your seed data changes.' The Ask the studio form does not exist, so the form check could not run. I could not run the republish and design-change checks, because no credits were left and I could not publish a web version. I did not press the export or edit and delete in the panel.

• The warning that the data is disposable and refreshes when the seed changes was not tested, because I could not change the seed.

The pass was bought in the app with a test card number. No Stripe account was created and no keys were asked for. The six checks that depend on payments and emails are left out.

The Pay $95 button is a placeholder. The app's code says 'Simulated Stripe test-mode checkout', and the page says no real charge is made. It took 4000 0000 0000 0002, a number Stripe's own test list marks as declined, and answered 'Pass purchased' with an order number and 5 credits. A signed-in member can also call the pass request by itself, with no card, and get the credits, which I did with six extra accounts. No booking email reached my inbox: the email task was the ninth and was never reached.

The button also shows the text '·' instead of a dot.

• The placeholder is the app the builder made for me with no keys. A paid plan or my own Stripe keys might change it, but I did not try.

The twelve changes were to be run one at a time on the live app after the build.

None was run. The free credits were gone when the build stopped, and the builder asked for a paid plan before any new request. The builder also said, after hitting the screen limit, that the next request on a paid plan would add the two missing screens by itself.

• The credits come back in about 23 hours, according to the builder, and I did not wait.

The Download Project menu was opened on the Free plan, the terms box was read, and the pricing page was checked for what each plan includes.

The Download menu offers Download Project, a zip of the full source code, and Get APK, an Android build for 10 credits. Pressing Download Project opened the upgrade screen instead of a file, so on Free there is no code download. The pricing page lists code export from Starter. The terms say: 'Content: You own your content', and 'IP Ownership: We own the Service, software, and related IP'. They also say accounts can be ended and to export your content in advance.

• I did not read all the terms, and the app depends on RapidNative's own database address until it is moved.

I emailed three questions to support@rapidnative.com on 27 October 2026, at about 21:49 UTC: how to stop people signing up as admin, how to export data and code, and how to cancel. The address is on RapidNative's contact page.

No reply had arrived when I wrote this, so support is not graded. I paid nothing, so there was nothing to cancel; the only control on a free account is Delete Your Account, and I did not press it.

• I will add the reply and the grade when it arrives.

The written checks were run by hand on the preview address of the app, signed in as a member, an instructor and an admin that I created. The six payment and email checks (C24 to C29) were left out, so the 30-check thresholds are applied in proportion to the 24 that remain.

Ten of the 24 checks passed, which is 42 percent and a **2**. The passes are sign-up, log-out and log-in, the timetable with all three classes, days, times and instructors, the places left on each class, booking, the booking on My bookings, cancelling and freeing the place, the full-class rule, the credit rule and the rule that a member never sees another member's bookings. The fails are the password reset, the instructor and admin screens, attendance, adding, editing and deleting classes, the admin bookings, the CSV, the count per class, the Ask the studio form and its inbox, and the ten seed facts.

Dana Okafor, the studio's owner, appears nowhere in the app, and the app's database holds two enquiries, from Priya Sharma and Marcus Lee, that I never wrote. The brief said to invent nothing. Cancelling a booking gave the place back but not the credit.

• The checks were run on the preview address, which is not a published app. The unfinished tasks and the screen limit are why most fails happened.

Sign-up and log-in were run for a member, a second member, an instructor and an admin. A password reset was requested by email. The two attacks from the brief were sent as the app's own database requests, with a second member's session: A1 asked for another member's bookings by their number, A2 sent the admin-only change and delete for a class. I also tried a sign-up that asks for the admin role.

Attack 1 returned an empty list. Attack 2 returned an empty success reply and changed nothing: all three classes were still there, with Mat Flow's capacity still 12. A member could read no other member's profile. So both attacks were **blocked**.

The weak spot is the sign-up page. The address ends in role=admin, and a sign-up there made me an admin with no check. The app has no admin screens, but that admin could read the studio's inbox, which holds the two enquiries that were invented.

The reset email came from noreply@rnproject.dev in about a minute. The page the link opened said the link had expired or was already used, on three tries, and I never set a new password. A direct request to a link of the same kind was answered with a session, so I cannot say where the fault is.

• RapidNative's own security scan was not run. The admin sign-up only matters once the admin screens exist, but the role is already stored.

The Publish button, the Share menu, the Run on your phone menu and the Download menu were opened. Google's Lighthouse was run on a simulated phone three times on the log-in page of the preview. The layout was checked at 360, 768 and 1440 pixels on the timetable, a class, My bookings and Buy a pass.

There is **no web publishing**. Publish opens a store-submission service from a partner: a free do-it-yourself guide, or a flat fee of $349.50 for one store and $499.50 for both, shown as half price. The app lives on a preview address, rapidnative-app-jyxeo.rapidnative.dev, which opened in a browser and has a Share menu with a preview link. The sitemap page shows it is a development build.

The log-in page scored 56 of 100 on a phone, three times. The largest content took 8.2 seconds, the page weighed 1.3 MB and the layout did not shift. There was no sideways scroll at any width. On a desktop the cards stretch across the whole screen, which I count as one fault.

• I could not connect a custom domain, time a publish or seed 100 classes. A paid web publish does not seem to exist, so I do not know what a published app would score. Adding the app to a home screen was not tested.

The pricing page, the upgrade screen and the credit meter were read on 28 October 2026.

Free is $0. The pricing page says 20 AI credits a month and 5 screens a project, while the app counted 10 free credits a day. The first task of nine cost about 3 credits, and the day's 10 credits covered six of nine tasks. A finished app and the twelve changes would need more. The paid plans are $20 a month for 50 credits, $49 for 150, $99 for 330 and $199 for 725, all with unlimited screens. Full-stack projects are billed by how much each reply writes, and other projects cost a flat 1 credit, according to the terms box. I saw no top-up or pay-as-you-go button, only plans. The running cost of a live app is not stated.

• I did not test whether Starter's 50 credits would finish the build and the twelve changes. Yearly prices were not recorded.