IS BASE44 SAFE?

Base44 generates REST API endpoints that are publicly accessible by default. Without adding authentication middleware, anyone can read, modify, or delete your application data by calling these endpoints directly.

Auto-generated forms accept any input without server-side validation. Attackers can submit malicious payloads including SQL injection strings, XSS scripts, or oversized data that crashes your backend.

Generated APIs have no throttling or rate limiting. This allows brute-force attacks on login endpoints, resource exhaustion through rapid requests, and abuse of any public-facing functionality.

When Base44 integrates with Supabase or Firebase, the generated security rules are often too permissive. Row Level Security policies may be missing entirely, allowing any authenticated user to access all records in the database.

Generated applications ship without Content-Security-Policy, X-Frame-Options, or proper CORS configuration. This leaves your app vulnerable to clickjacking, XSS, and cross-origin data theft.

Are Base44 apps secure by default?

No. Base44 prioritizes speed of development over security defaults. Generated APIs are typically public, inputs are unvalidated, and database rules are permissive. You need to manually harden every layer before going to production. Run an UNPWNED scan for completed outside-in findings. Free reports show finding titles and severities; paid reports add full detail and remediation guidance. Input, database-rule, and authorization logic require direct review.

How do I add authentication to Base44 generated endpoints?

Add authentication middleware that verifies JWT tokens or session cookies on every API route. If your Base44 app uses Supabase, enforce Row Level Security policies so database queries are automatically scoped to the authenticated user. UNPWNED checks common public endpoint paths for reachability and exposed response data. Authentication, JWT, session, and object-level authorization require API-specific testing or code review.

Does Base44 handle database security automatically?

Base44 creates database tables and basic CRUD operations but rarely configures proper security rules. If you are using Supabase, you must write RLS policies for every table. If you are using Firebase, review your Firestore security rules. UNPWNED performs bounded anonymous-access checks using public client configuration and reports confirmed public exposure. Complete RLS and Firebase rule correctness require direct review.

What are the biggest risks of deploying a Base44 app without review?

The biggest risks are unauthenticated API access, SQL injection through unvalidated inputs, and overly permissive database rules that expose all user data. A single missing auth check can leak your entire database. UNPWNED can identify publicly reachable endpoints and exposed database-rule signals; SQL query handling still requires code review or SAST. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.

How often should I scan my Base44 application?

Scan after every significant change to your application, especially after regenerating code or adding new features through the AI builder. Each regeneration can introduce new endpoints or change security configurations. Paid UNPWNED monitoring reruns bounded outside-in checks on schedule and alerts when completed findings change; it does not observe every internal change.