Base44 app security check
Built your app with Base44? Paste your live link and get a free score before you share it. Under a minute, no sign-up.
Only scan apps you own or have permission to scan.
What to check on a Base44 app
Base44 handles hosting, login and the database for you, which makes it easy to go live fast. What stays in your hands is who can see each record and where your API keys live.
If a third-party key ends up in frontend code, every visitor can read it. Entity permissions decide whether one user can see another user's data.
What the free scan checks
- Leaked keys in your frontend
Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.
- Files left on the server
Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.
- Public source maps
We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.
- Security headers and CORS
HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.
Base44 pre-launch checklist
- Review entity permissions. For each entity, check who can read, create and update records, so users only see their own.
- Keep API keys in backend functions. Use secrets or backend functions for third-party keys, never frontend code or prompts.
- Open your app logged out. Use a private window. Anything you can see there, anyone can.
- Test as a second user. Sign up with another account and confirm it can't see the first account's data.
- Run the free scan. Fix anything critical or high first.
FAQ
- Does it work on base44.app and custom domains?
- Yes. Paste the public link people use to reach your app, either the base44.app address or your own domain. The report notes when it detects a Base44 app.
- Does it check my entity permissions?
- No. It only sees what your live site serves to a logged-out visitor. Review permissions in Base44 and test with a second account.
- Do I need to sign up?
- No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
- What does it cost?
- The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
- Does it attack my site?
- No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
- What doesn't it check?
- Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.