Base44 builds the whole app for you: pages, data, logins and hosting, all on Base44's own back end. That means fewer moving parts than many AI builders, and fewer places for keys to leak. But the most important security decisions are still yours.
Base44's security overview says it directly: "You are responsible for your app's security settings." This checklist, written for founders rather than security experts, covers what to check.
1. Data permissions (the most important part)
Base44 stores your app's data as entities, a bit like tables, and each one has permissions for who can create, read, update and delete records. Base44 says it "automatically sets up data permissions as you build your app", and warns: "If permissions are not set up correctly, the wrong people could view or change data in your app."
- Open the security settings for every entity that holds user data. Look for "All Users" on read, update or delete. Base44 explains that it means anyone can do it, "even without signing in."
- Make sure each person sees only their own records, such as their own orders or messages, unless sharing is intended.
- Check sensitive fields too. Base44 supports field-level rules, so a record can be visible while a private field in it isn't.
- Do the two-account test. Sign up as user A and create something. Log in as user B in another browser and try to see or change A's data.
2. Who can open your app
A Base44 app can be Public (anyone on the internet, no sign-in), Private (only invited people) or limited to your workspace. Base44's access docs note that apps that look like public sites, such as landing pages, are set to Public automatically, and that making an app private needs a Starter plan or higher.
Check the setting matches what the app is for. An internal tool or a client portal shouldn't be open to everyone.
3. Logins and roles
- Base44 apps have two built-in roles: Admin and User. Check who has Admin, and that admin-only pages and data are restricted by permissions, not just hidden.
- Pick sign-in options that fit your users, and require multi-factor authentication for admins if your plan allows it (Base44 says requiring MFA needs a Builder plan or higher).
4. Secrets and backend functions
- Store API keys in Base44's secrets, which Base44 says are "only accessible from your app's backend and are never exposed to the people using your app." Never paste a key into page code or a prompt that puts it in the front end.
- Backend functions should check who is calling before doing anything user-specific.
- Be careful with the service role. Base44's developer docs say code using
asServiceRole"bypasses both RLS and FLS entirely", so every function that uses it must do its own checks. - Rate limits or credit limits on anything that costs you money, like AI calls.
5. Payments
- If you take payments with Stripe, webhooks must verify the signature (Stripe's docs).
- Paid features are unlocked by data the user can't change, checked by permissions or a backend function.
6. Run Base44's security scan
Base44 has a built-in security scan on every plan, including free. It looks at permissions, private fields, exposed secrets, backend functions, dependencies and security headers. Run it before you publish and after big changes.
Two things to know. First, "the scan doesn't apply fixes automatically, so check what each fix changes first." Second, it can't know your business rules: whether a manager should see another team's records, or whether a field is private. That's what the two-account test and a human review are for.
7. Platform issues happen too
In July 2025, security firm Wiz reported a flaw that let anyone register for private Base44 apps using only the app's id. It was fixed in less than 24 hours, and Base44 said that, so far, it had found no evidence that any customer was affected. It's a reminder that security depends on both the platform and your own settings. Wiz suggested app owners review their app's analytics for unusual visits and sign-ups.
8. Where to start
If you only have an hour: run Base44's security scan, check every entity for "All Users" permissions on private data, and do the two-account test.
Want a second pair of eyes?
Axieo Guard is our security audit for AI-built apps, including apps built with Base44. A free mini scan checks five high-impact items. A full audit covers 25 checks, adapted to Base44's back end, with a plain-English report and a recommended fix for every finding. We're a Canadian company, and we only test with your written permission, read-only. Get a free mini scan.