What are the security best practices for Base44?

Best practices for Base44 security include enabling HTTPS enforcement, configuring authentication on all sensitive endpoints, limiting CORS to specific trusted origins, and adding Content Security Policy headers where possible. Review all auto-generated API routes to ensure none expose internal data or admin functionality to unauthenticated users. Keep any third-party integrations updated and use environment variables for secrets rather than hardcoding them in the application configuration. UNPWNED helps you verify these best practices are properly implemented by scanning your live Base44 app and providing a prioritized list of security improvements.