Security scan for Base44 apps: what to check before you go live

Why Base44 apps need extra attention

In August 2025, security researchers found critical flaws in the Base44 platform itself: an open redirect in the login flow that could steal user tokens, stored XSS that let injected JavaScript run on the trusted domain, and a design where the main account JWT was passed to user-built apps through the URL. These were platform-level bugs that Base44 has since addressed.

But the code Base44 generates for your app can have its own problems, and those are yours to fix.

The 5 most common issues in Base44-built apps

1. No authentication on API endpoints. The AI creates endpoints that work when you test them, but never checks whether the caller is signed in. Anyone who finds the URL can call them.
2. Client-side enforcement only. Premium features, role checks, and access controls that exist only in the frontend JavaScript. Anyone can bypass them in DevTools.
3. Secrets in client-side code. API keys for third-party services (payment providers, AI APIs, email services) embedded in the frontend bundle where every visitor can read them.
4. No ownership checks on data. A signed-in user can access another user's records by changing an ID in the request.
5. Database access without row-level restrictions. If your app uses Supabase or another database, the AI may leave access rules wide open to get things working fast.

How to check your Base44 app yourself

1. Export your code. If Base44 lets you export or connect to GitHub, get the source code into a repo you control.
2. Search for secrets: look for sk_, sk-, secret, api_key, service_role in the codebase. None of these should be in client-side files.
3. Check every API endpoint or server function. Does it verify the session? Does it check that the user owns the data they're requesting?
4. Look at what the browser can see. Open DevTools → Network tab and read every request your app makes. Check what keys and tokens are being sent.
5. If your app uses Supabase, check that Row Level Security is enabled on every table and that policies verify ownership, not just authentication.

How to scan it with SetRepo

1. Export your Base44 app's code to a GitHub repo, or download it as a zip.
2. On SetRepo, connect the repo (read-only access) or upload the zip. Add your live URL if the app is published.
3. Run a free Quick scan: secrets in code and git history, vulnerable dependencies, risky code patterns, route-level access control, and your live site's security headers.
4. Each finding comes with a fix prompt. Paste it back into your builder to fix it.
5. A Deep scan adds an AI review of access control and business logic — the bugs that pattern matching can't catch.

FAQ

Has Base44 fixed its platform vulnerabilities?

The critical issues reported in August 2025 (open redirect, stored XSS, exposed JWTs) have been addressed. But the code your specific app generates is separate — those patterns depend on what you built and need their own check.

Can I scan a Base44 app without exporting the code?

You can add your live URL for a headers and client-side check. For a full scan of the source code, you need to export it to a repo or zip.

Does SetRepo store my code?

No. Your files are deleted when the scan finishes, and secret values are never stored or shown.

What does it cost?

The Quick scan is free with no credit card. A Deep scan is a one-time payment, and there are monthly plans if you scan often. See setrepo.com/pricing.