How do I check if my Base44 app's data is exposed?
Check each Base44 entity's read permission: any entity holding customer or private data should be Private, because the app id is public and open entities can be queried without a login. The free ArgosX scan discovers your entities and shows exactly what an anonymous visitor can read on the live app; a Pro scan signs in as two of your test accounts to check whether users are separated from each other.
Security scan for Base44 apps
Base44 runs its own backend rather than Supabase. Your app id is public by design, and each data entity has its own read and write permissions. In Base44 apps we have tested (Aug to Sep 2026), entities were often left readable by anyone, so records could be fetched without signing in even when the app shows a login screen. Whether that is a problem depends on the data: a public catalog is fine, a customer list is not. We probe the data layer directly, the way the backend actually answers.
Runs on your deployed URL in minutes. No signup, no card, and it never logs in: public surface only.
What Base44 apps typically get wrong
An entity whose read permission is left open can be queried without a login, because the app id is public. Any entity holding customer or private data should be set to Private.
The backend answers directly, so a tidy UI with a login screen can still sit on entities anyone can read around it. The data layer is what matters, not the UI.
Even with reads locked, writes and per-record ownership need their own rules, or one signed-in user can reach another's records.
What the scan checks on your live app
We discover your app's entities and probe them the way the Base44 backend actually answers, showing exactly what an anonymous visitor can read.
Real private keys in the pages and bundles your app sends to visitors.
The standard deploy-level protections: CSP, HSTS, frame protection.
On a Pro scan, with your permission and your test accounts, we sign in as two users and check whether one can read or edit the other's records, with proof.
Being straight about scope: the free scan sees only what an anonymous visitor sees. Signed-in cross-user testing is a paid scan, needs your explicit permission and test accounts you provide, and takes tens of minutes because we actually drive the app. Plans on pricing.
Does Base44 check this for you?
Base44 gives you the controls: each entity can be set to Private, and that is the single most important switch to flip. What an independent scan adds is verification from the outside: it tells you what an anonymous stranger can actually read from your live app today, whatever the settings screen says, and a Pro scan checks whether signed-in users are separated from each other.
Common questions
They can, if an entity's read permission is left open. The app id is public, so records on an open entity can be queried without a login even when the app shows a login screen. The free scan probes your entities and shows you exactly what answers.
The free scan is read-only against your public surface: it queries what an anonymous visitor can already query, and does not log in or write data. Signed-in testing happens only on a paid scan, with your permission and test accounts you provide.
Prefer the checklist first? See the Base44 pre-launch checklist.
Platform behavior described as of September 2026. Platforms change their defaults; the scan tests what your app actually does today.