How secure are Base44 API endpoints?

Base44 generates API endpoints automatically based on the data models developers define, but these endpoints may not include comprehensive security controls by default. Common issues include overly permissive CORS policies, missing rate limiting, and insufficient authorization checks that could allow users to access data belonging to other accounts. The auto-generated nature of these APIs means developers may not be fully aware of all exposed endpoints and their access patterns. UNPWNED checks common public API paths for reachability, exposed response data, CORS, rate-limit, and error-disclosure signals. Authentication and object-level authorization require API-specific testing or code review.