IS BASE44 SAFE?

Base44 generates REST API endpoints that are publicly accessible by default. Without adding authentication middleware, anyone can read, modify, or delete your application data by calling these endpoints directly.

Auto-generated forms accept any input without server-side validation. Attackers can submit malicious payloads including SQL injection strings, XSS scripts, or oversized data that crashes your backend.

Generated APIs have no throttling or rate limiting. This allows brute-force attacks on login endpoints, resource exhaustion through rapid requests, and abuse of any public-facing functionality.

When Base44 integrates with Supabase or Firebase, the generated security rules are often too permissive. Row Level Security policies may be missing entirely, allowing any authenticated user to access all records in the database.

Generated applications ship without Content-Security-Policy, X-Frame-Options, or proper CORS configuration. This leaves your app vulnerable to clickjacking, XSS, and cross-origin data theft.

Are Base44 apps secure by default?

No. Base44 prioritizes speed of development over security defaults. Generated APIs are typically public, inputs are unvalidated, and database rules are permissive. You need to manually harden every layer before going to production. Run an UNPWNED scan to see exactly what needs fixing.

How do I add authentication to Base44 generated endpoints?

Add authentication middleware that verifies JWT tokens or session cookies on every API route. If your Base44 app uses Supabase, enforce Row Level Security policies so database queries are automatically scoped to the authenticated user. UNPWNED checks for exposed endpoints and missing auth.

Does Base44 handle database security automatically?

Base44 creates database tables and basic CRUD operations but rarely configures proper security rules. If you are using Supabase, you must write RLS policies for every table. If you are using Firebase, review your Firestore security rules. UNPWNED scans detect missing RLS and open database configurations.

What are the biggest risks of deploying a Base44 app without review?

The biggest risks are unauthenticated API access, SQL injection through unvalidated inputs, and overly permissive database rules that expose all user data. A single missing auth check can leak your entire database. Scan with UNPWNED before deploying to catch these issues.

How often should I scan my Base44 application?

Scan after every significant change to your application, especially after regenerating code or adding new features through the AI builder. Each regeneration can introduce new endpoints or change security configurations. UNPWNED monitoring can alert you automatically when new vulnerabilities appear.