Is my Base44 app secure?

Base44 secures the platform, but data rules, API keys and backend functions are on you. A 5-minute check, what the 2025 Wiz finding means, and which headers you can set.

A Base44 app is as secure as the settings you give it. Base44 handles the platform (hosting, encryption, audits). You still have to set who can open the app, add data rules to every entity, keep API keys in secrets, and lock down backend functions. Then check from the outside that nothing private reaches the browser.

Base44's own docs put it plainly: "You are responsible for your app's security settings. Base44 provides the tools, but always review your permissions and run a security scan before you publish" (Base44 security overview).

What usually goes wrong

• Entities with no data rules. If no row level security is defined on an entity, all records are accessible to all users (Base44 docs). A "Leads" or "Orders" table with no rules is readable by anyone the app lets in.
• Rules set to true. A permission of true means all users, including signed-out visitors (Base44 docs).
• Secret keys in page code. An OpenAI or Stripe secret key pasted into the frontend ships to every visitor. Base44 says to call third-party APIs from backend functions and keep keys in secrets management (Base44 docs).
• Backend functions anyone can call. Each function has its own web address. One that doesn't check who's calling can be run by a stranger (Base44 docs). Functions that use asServiceRole skip every data rule, so they must do their own checks (Base44 docs).
• Login tokens in localStorage. Base44 stores sign-in tokens in the browser's localStorage, not HttpOnly cookies (Base44 security overview). Any script running on your page can read them, so be careful with third-party scripts.

The Base44 incident, in one paragraph

In July 2025, Wiz Research found two Base44 sign-up endpoints that let anyone register a verified account on a private app using only its app ID, which is visible in the app's URL. Wix (Base44's owner) fixed it within 24 hours of the July 9 report, found no evidence of abuse, and said app owners didn't need to do anything (Wiz Research). It's a good reminder that private apps should also have data rules, not just a private setting.

5-minute check

1. Run Base44's security scan. Dashboard → Security → Run Security Scan. It checks data permissions, exposed secrets, backend functions, dependencies and the two headers Base44 lets you set (Base44 docs).
2. Check every entity's rules. For each entity with personal data, make sure read, update and delete are limited, for example to records the user created.
3. Test as a stranger. Use Base44's preview-as-user testing, then open your live app in a private window while signed out and see what loads.
4. Check what the browser gets. DevTools → Network → reload, then search the responses for sk-, sk_live_ and other secret key prefixes. Or use the free scan above, which reads your live page and its JavaScript.
5. Set the headers you can. Settings → Browser Security: turn off iFrame embedding unless you need it, and turn on Protect camera and location (Base44 docs).

Security headers on Base44 hosting

We checked two public *.base44.app apps on Nov 2, 2026. Both sent Strict-Transport-Security, X-Content-Type-Options: nosniff and Referrer-Policy. One sent X-Frame-Options: DENY. Neither sent a Content-Security-Policy. Base44 says CSP and HSTS aren't configurable per app (Base44 security overview), so a missing-CSP finding on a Base44 app is expected. Fix what Base44 lets you fix (iframe embedding), and treat CSP as a job for a proxy on a custom domain if your app handles payments or sensitive data.

Review this app's security before I publish. 1) List every entity and its read, create, update and delete rules, and flag any with no rules or rules set to true. 2) For entities with personal data, limit read, update and delete to records the signed-in user created, and admin for everything else. 3) Find any API key, password or token in frontend code and move it to secrets, used only from a backend function. 4) List every backend function anyone can call without signing in, and what data each one can read or change. Show me the changes before you make them.

What the free ShipLatch scan can and can't see

It reads what any visitor can see: your live page and up to 20 of its scripts, public source maps, response headers, and a short list of files that should never be public. It flags leaked secret keys, exposed files and missing headers, and it knows Base44's own badge source map isn't your code. It does not sign in or read your Base44 entities, so it can't tell you whether your data rules are right. Use Base44's scan and test-as-user preview for that.

FAQ

Is Base44 itself secure?
Base44 runs the platform security: encryption, SOC 2 Type II and ISO 27001, and regular penetration tests, per its docs. Its docs also say you are responsible for your app's own settings: who can open it, the data rules on each entity, and which backend functions anyone can call.

Was there a Base44 security breach?
In July 2025 Wiz Research found that two sign-up endpoints let anyone register on a private Base44 app using only its app ID. Wix fixed it within 24 hours of the July 9 report, said there was no evidence it was abused, and no action was needed from app owners.

What happens if I don't set data rules on an entity?
Base44's developer docs say that if no row level security is defined on an entity, all records are accessible to all users. Set read, create, update and delete rules on every entity that holds anything personal.

Where should I put API keys in a Base44 app?
In Base44's secrets management, read only from backend functions. Never paste an OpenAI, Stripe or other secret key into page code or a prompt that ends up in the frontend, because anyone can read what the browser downloads.

Can I add a Content-Security-Policy to a Base44 app?
Not inside Base44. Its docs say you can control iframe embedding and Permissions-Policy per app, but Content-Security-Policy and Strict-Transport-Security are not configurable at the app level. A proxy you control in front of a custom domain is the usual workaround.

Does the ShipLatch scan test my Base44 data rules?
No. The free scan is passive: it reads what any visitor's browser can see (your page, its JavaScript, response headers and a short list of files that should never be public). It does not log in or query your Base44 entities. Base44's built-in security scan and its test-as-user preview are the right tools for data rules.

Related: Hide API keys in an AI-built app · Security headers for vibe-coded apps · Source maps in production · Pre-launch checklist

Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook. See what's inside.

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist