Base44
Is Base44 secure?
Base44 is not a security product, and it is not automatically unsafe. Base44 hosts the app it builds. The hosted URL is the thing to paste. Public files and headers on that host are in scope.
Base44 project settings and databases are not opened. The scan does not log in as a user of the app.
A useful check is the deployed URL
Paste a URL you own. The scan is passive. It does not log in, brute-force paths, or query a database. Supabase Row Level Security and Firebase security rules are not read. Those stay marked as coming soon.
- Base44: Exposed API keys
- Base44: Supabase RLS
- Base44: Firebase security rules
- Base44: Missing security headers
- Base44: Open CORS
- Base44: Exposed .env files
- Base44: Auth misconfiguration
- Base44: Cookie flags
- Base44: Clickjacking protection
- Base44: Exposed git metadata
- Base44: Missing robots.txt
Is Base44 secure?
Base44 is a way to build an app. The security question is about the URL you publish. Base44 hosts the app it builds. The hosted URL is the thing to paste. Public files and headers on that host are in scope.
What does a free scan cover?
The public page, up to 10 same-origin scripts, headers, cookies, robots.txt, sitemap.xml, homepage links, and five paths: /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
What will a scan of a Base44 URL miss?
Base44 project settings and databases are not opened. The scan does not log in as a user of the app.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.