Security scan for Base44 apps
Base44 runs its own backend rather than Supabase. Your app id is public, and some entities default to permissive reads. Put those together and app data can be readable without anyone signing in, which is exactly the case builders miss, because the app looks locked down from the front end. We probe the data layer directly, the way the backend actually answers.
Runs on your deployed URL in minutes. No signup, no card, and it never logs in: public surface only.
What Base44 apps typically get wrong
Some Base44 entities default to public reads. With a public app id, that means your records can be queried without a login. Each entity needs to be set to Private.
The backend answers directly, so a tidy UI with a login screen can still sit on entities anyone can read around it. The data layer is what matters, not the UI.
Even with reads locked, writes and per-record ownership need their own rules, or one signed-in user can reach another's records.
What the scan checks on your live app
We discover your app's entities and probe them the way the Base44 backend actually answers, showing exactly what an anonymous visitor can read.
Real private keys in the pages and bundles your app sends to visitors.
The standard deploy-level protections: CSP, HSTS, frame protection.
On a Pro scan, with your permission and your test accounts, we sign in as two users and check whether one can read or edit the other's records, with proof.
Being straight about scope: the free scan sees only what an anonymous visitor sees. Signed-in cross-user testing is a paid scan, needs your explicit permission and test accounts you provide, and takes tens of minutes because we actually drive the app. Plans on pricing.
Does Base44 check this for you?
Base44 gives you the controls: each entity can be set to Private, and that is the single most important switch to flip. What an independent scan adds is verification from the outside: it tells you what an anonymous stranger can actually read from your live app today, whatever the settings screen says, and a Pro scan checks whether signed-in users are separated from each other.
Common questions
They can, if entities are left on the permissive default. The app id is public, so records on a permissive entity can be queried without a login even when the app shows a login screen. The free scan probes your entities and shows you exactly what answers.
The free scan is read-only against your public surface: it queries what an anonymous visitor can already query, and does not log in or write data. Signed-in testing happens only on a paid scan, with your permission and test accounts you provide.
Prefer the checklist first? See the Base44 pre-launch checklist.
Platform behavior described as of September 2026. Platforms change their defaults; the scan tests what your app actually does today.