How secure are Base44 API endpoints?

Base44 generates API endpoints automatically based on the data models developers define, but these endpoints may not include comprehensive security controls by default. Common issues include overly permissive CORS policies, missing rate limiting, and insufficient authorization checks that could allow users to access data belonging to other accounts. The auto-generated nature of these APIs means developers may not be fully aware of all exposed endpoints and their access patterns. UNPWNED scans Base44 API endpoints to detect missing authentication, authorization bypasses, and other API security weaknesses.