What are the security best practices for Base44?

Best practices for Base44 security include enabling HTTPS enforcement, configuring authentication on all sensitive endpoints, limiting CORS to specific trusted origins, and adding Content Security Policy headers where possible. Review all auto-generated API routes to ensure none expose internal data or admin functionality to unauthenticated users. Keep any third-party integrations updated and use environment variables for secrets rather than hardcoding them in the application configuration. UNPWNED checks the externally observable TLS, header, CORS, exposure, endpoint, dependency, rate-limit, and error-disclosure portions. Paid reports add prioritized remediation guidance; internal authentication and authorization require direct review.