[{"data":1,"prerenderedAt":320},["ShallowReactive",2],{"guide-base44-en":3},{"id":4,"title":5,"body":6,"cover":286,"coverAlt":287,"description":288,"extension":289,"faq":290,"keywords":303,"meta":309,"navigation":310,"path":311,"platform":67,"published":312,"seo":313,"stem":314,"tldr":315,"updated":312,"__hash__":319},"platform_en\u002Fis-your-base44-app-safe.md","Is your Base44 app safe?",{"type":7,"value":8,"toc":275},"minimark",[9,13,16,24,29,32,43,49,52,61,64,68,72,75,80,104,117,120,124,127,134,137,145,149,152,158,161,169,173,176,181,184,196,204,208,214,220,226,232,242,267],[10,11,12],"p",{},"Base44 does something the other builders do not, and it is worth knowing before\nyou go looking for problems: your data never answers the internet directly.",[10,14,15],{},"Your app asks Base44 for something, Base44 asks the database, and the answer\ncomes back the same way. There is no address a stranger can type. On most\nvibe-coded apps the single biggest cause of leaked data is a table left readable\nto anyone holding the project address, and on Base44 that mistake is not really\navailable to you.",[10,17,18,19,23],{},"Here is the part that guide after guide gets wrong: ",[20,21,22],"strong",{},"that does not make your app\nsafe, it makes it safe in one specific way."," The risk moves, and where it moves\nis predictable enough that we can tell you now, before you scan anything.",[25,26,28],"h2",{"id":27},"what-base44-keeps-off-the-internet-for-you","What Base44 keeps off the internet for you",[10,30,31],{},"The stockroom, to use the obvious comparison.",[10,33,34,35,38,39,42],{},"Think of your app as a shop. Everything a visitor's browser downloads is the\n",[20,36,37],{},"shopfront"," and it is handed over in full to anyone who loads the page: a\nbrowser cannot display something it was not sent. Behind that is the\n",[20,40,41],{},"stockroom",", your data. On most builders the stockroom is a separate building\nwith its own address on the same street, and whether strangers can walk in\ndepends on a setting you may never have seen. On Base44 there is no street door.",[44,45],"diagram",{"alt":46,"caption":47,"src":48},"A Base44 app arrows into a Base44 panel, which arrows on to a database cylinder. Below it, an anonymous visitor's route to that same database is drawn as a dashed line with a red cross through it.","The dashed line is the route the other builders have. It is drawn here so you know what is missing on purpose.","\u002Fguides\u002Fbase44\u002Fwhere-your-data-sits-1600x820.png",[10,50,51],{},"In practice that means there is nothing to paste into a browser. On a\nSupabase-backed app anyone can lift the project address out of your bundle, add\na table name, and see what comes back. Do the same on a Base44 app and the only\naddress you find is your own, on your own domain, answering the things your app\nwas written to answer.",[10,53,54,55,60],{},"It shows up in the grades. Across the Base44 apps in\n",[56,57,59],"a",{"href":58},"\u002Fresearch\u002Fvibe-coded-app-security-2026","our scan of live vibe-coded apps",",\nalmost every one lands an A or a B, and the failures that pull other builders\ndown to a D barely appear.",[10,62,63],{},"It also has one honest consequence, which is that nobody outside can verify it,\nincluding us. A check from the internet can only try doors that exist. There is\nno door here, so there is nothing to report, and a scanner that printed\n\"database: secure\" on that basis would be inventing a result.",[65,66],"guide-cta",{"platform":67},"base44",[25,69,71],{"id":70},"is-a-key-in-your-base44-app-a-problem","Is a key in your Base44 app a problem?",[10,73,74],{},"Usually not, and the two kinds look nearly identical.",[44,76],{"alt":77,"caption":78,"src":79},"Two cards side by side. The publishable key, marked with a green tick, is labelled fine in the browser and shows the identifiers sb_publishable_, anon and pk_live. The secret key, marked with a red cross, is labelled server only and shows sb_secret_, service_role and sk_live.","Both are called API keys. Only one of them was ever meant to be readable.","\u002Fguides\u002Ftwo-kinds-of-key-1600x760.png",[10,81,82,83,86,87,90,91,95,96,99,100,103],{},"A ",[20,84,85],{},"publishable"," key names a project and does nothing else. It is meant to be\nreadable, and finding one is not a finding. A ",[20,88,89],{},"secret"," key, the kind spelled\n",[92,93,94],"code",{},"sb_secret_…",", ",[92,97,98],{},"service_role"," or ",[92,101,102],{},"sk_live_…",", bypasses every rule you have\nwritten and can read and change everything.",[10,105,106,107,111,112,116],{},"Base44 keeps its own credentials on the server, so a key sitting in your app is\nusually not Base44's at all. It is from something you connected yourself: a maps\nkey, an analytics key, a payment key pasted in to get one feature working. The\nmost common one we find on Base44 apps is a Google API key, which is\n",[56,108,110],{"href":109},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","worth understanding rather than panicking about","\nbecause an unrestricted one can be spent by strangers.\n",[56,113,115],{"href":114},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Reading which key you have","\ntakes about a minute.",[10,118,119],{},"If you do find a real secret, the order matters. Rotate it where it was issued,\nin Google Cloud or Stripe or wherever it came from, and take it out of your code\nafter that. Deleting the line first closes nothing: the old value is already in\nevery cached copy of your site and in whatever a crawler saved last week.",[25,121,123],{"id":122},"the-setting-that-is-wrong-on-almost-every-base44-app","The setting that is wrong on almost every Base44 app",[10,125,126],{},"Not a key, and not the database. It is who your API is willing to talk to.",[10,128,129,130,133],{},"A browser normally refuses to let one website read another website's data. That\nrule is why a page you open cannot quietly call your bank and put your balance\non screen. A response header called CORS is what waives it, and set to ",[92,131,132],{},"*"," it\nwaives the rule for everybody, so a site you have never heard of can call your\napp's API from your visitor's browser and read what comes back.",[10,135,136],{},"On the Base44 apps we have scanned this is the most common finding by a\ndistance. It is also the one people argue with, and the argument is fair, so\nhere is the honest version. A wildcard in front of an address that demands a\nlogin is weak news, because the other site still has no credentials to send. A\nwildcard in front of an address that answers anybody is the real thing, and\nabout half the Base44 apps we scanned have at least one address that hands back\ndata to a plain request with nobody signed in. Those are two different problems\nwearing one label, and the second is the one to go looking for.",[10,138,139,140,144],{},"Neither is a mistake you made. A wildcard is what a build tool ships when nobody\ntold it otherwise, usually so a preview domain and a live domain both work while\nyou are building. The ",[56,141,143],{"href":142},"\u002Fblog\u002Fcors-wildcard-security-risk","short write-up"," has the\nfix, which is naming your own domain in place of the star.",[25,146,148],{"id":147},"your-original-code-published-beside-the-app","Your original code, published beside the app",[10,150,151],{},"The second most common finding, and the one you can check without any tools at\nall.",[10,153,82,154,157],{},[20,155,156],{},"source map"," is a file that turns the compressed JavaScript a browser runs\nback into what you wrote, with the original filenames, the comments and the\nfolder structure intact. Build tools generate them so an error in production\npoints at a real line instead of at column 4,812 of one enormous file. That part\nis genuinely useful. Publishing them next to the app is the part that costs you.",[10,159,160],{},"Roughly three in five Base44 apps we scanned ship theirs. No data leaks because\nof it, and nothing about your app behaves differently, which is exactly why it\ngoes unnoticed for months. What changes is the effort in everything else:\npicking an endpoint out of a minified bundle is slow, fiddly work, and reading\nyour own source is no work at all. Every other finding on this page gets cheaper\nto find once your code is legible.",[10,162,163,164,168],{},"Checking takes under a minute. Open your live app, press F12, and look at the\nSources panel. If the file tree there looks like your project, with the names\nyou gave things, the maps went out with the build, and the\n",[56,165,167],{"href":166},"\u002Fblog\u002Fsource-maps-exposed-in-production","longer version"," covers what to change.",[25,170,172],{"id":171},"if-you-plugged-in-your-own-database","If you plugged in your own database",[10,174,175],{},"Then the advantage at the top of this page does not apply to that part, and the\nusual rules come back.",[44,177],{"alt":178,"caption":179,"src":180},"A Base44-built app and an anonymous visitor drawn with arrows pointing at the same database cylinder. Below, two outcomes: with RLS off everyone is answered, with RLS on only your app is.","This picture is about a database you attached yourself. Base44's own data has no arrow from the stranger.","\u002Fguides\u002Fbase44\u002Fwho-the-database-answers-1600x820.png",[10,182,183],{},"Roughly a quarter of the Base44 apps we scan name a Supabase project of their\nown. That project answers the internet directly, exactly like every other\nbuilder's, so Row Level Security is now yours: a per-table switch deciding row\nby row who may read what.",[10,185,186,187,190,191,195],{},"Two things decide whether you have it. Supabase enables it ",[20,188,189],{},"by default for\ntables created in the dashboard's Table Editor",", and not for tables created by\nrunning SQL, which is how most generated setups create them. And the switch is\nonly half of it, because a policy that permits everyone leaves the table\n",[56,192,194],{"href":193},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","open while the dashboard reports it as secured",".",[10,197,198,199,203],{},"Storage works the same way and is easy to forget, because it lives in a\ndifferent part of the dashboard from the table rules. A bucket marked public can\nbe listed and downloaded by anyone who knows it is there, whether or not your\napp ever links to a file in it, and the\n",[56,200,202],{"href":201},"\u002Fblog\u002Fsupabase-storage-bucket-public","settings that decide that"," are worth\nreading once.",[25,205,207],{"id":206},"how-to-check-your-own-base44-app-in-about-ten-minutes","How to check your own Base44 app in about ten minutes",[10,209,210,213],{},[20,211,212],{},"Ask what your API tells other sites."," This is the one most likely to be wrong\nand the one nobody looks at, because nothing in your app misbehaves when it is\nset too widely.",[10,215,216,219],{},[20,217,218],{},"Open your live app with F12 and read the Sources panel."," If your own files\nare listed there under their own names, everyone else can list them too.",[10,221,222,225],{},[20,223,224],{},"Read any key in the app."," For each, ask whether you would put it on your\nhomepage. If the answer is no, it belongs on a server, and it needs rotating at\nthe source before it comes out of the code.",[10,227,228,231],{},[20,229,230],{},"Open Authentication → Policies, if you attached your own Supabase project.","\nAny table listed with Row Level Security disabled answers anyone holding the\nproject address, and that address is in your app.",[10,233,234,237,238,195],{},[20,235,236],{},"Then look from outside."," The steps above tell you what is configured. What a\nstranger can actually reach is a different question, and it is the one our free\nscan answers. It reads your live site as a visitor and gives you a grade in\nabout 20 seconds, no account: ",[56,239,241],{"href":240},"\u002F#scan","scan your app",[243,244,245],"key-takeaways",{},[246,247,248,252,255,258,261,264],"ul",{},[249,250,251],"li",{},"Base44 keeps your database off the internet. The biggest cause of leaked data in vibe-coded apps is not available to you.",[249,253,254],{},"Nobody can verify that from outside, us included. No door means no result, and no result is not a green tick.",[249,256,257],{},"The risk moves to the browser: an API that answers any website, and your source code published beside the app.",[249,259,260],{},"A wildcard in front of an address that needs no login is the version that matters, and about half of these apps have one.",[249,262,263],{},"A key in your bundle is usually from a service you connected yourself. Rotate it where it was issued, then delete it from the code.",[249,265,266],{},"Attach your own Supabase project and the usual Row Level Security and storage rules apply to it in full.",[10,268,269,270,274],{},"Start with the two that are almost always worth fixing: what your API tells\nother websites, and whether your original code shipped with the app. Then the\n",[56,271,273],{"href":272},"\u002Fchecklist","10-minute security checklist"," covers the rest.",{"title":276,"searchDepth":277,"depth":277,"links":278},"",3,[279,281,282,283,284,285],{"id":27,"depth":280,"text":28},2,{"id":70,"depth":280,"text":71},{"id":122,"depth":280,"text":123},{"id":147,"depth":280,"text":148},{"id":171,"depth":280,"text":172},{"id":206,"depth":280,"text":207},"\u002Fguides\u002Fbase44\u002Fis-your-base44-app-safe-en-1200x630.png","Reeve's security-check card for Base44 apps, with the Base44 logo on a white tile.","Base44 keeps your database off the internet, which removes the biggest risk in vibe-coded apps. What is left is a short list, and it is almost the same list on every Base44 app.","md",[291,294,297,300],{"q":292,"a":293},"If my database is not reachable, is there anything left to worry about?","Yes, but a shorter list than most people have. Your app still runs in a browser, and everything the browser receives is public: the code, any keys built into it, and the addresses it calls. The two things worth checking are whether those addresses answer requests from other websites, and whether a readable copy of your source went out with the build.",{"q":295,"a":296},"If nobody can check it from outside, how do I know my data is fine?","From inside, which is the only place that answer exists. Because requests go through Base44 rather than to a public address, whatever decides who may read what lives in your app and in the platform, where a stranger cannot probe it. So the useful questions are who can sign up, what a signed-up person can see, and whether any screen was built assuming nobody would look. An outside scan answers none of those. It answers the other half: what somebody reaches without signing up at all.",{"q":298,"a":299},"My scan says my API answers any website. Did I do that?","Almost certainly not on purpose. A wildcard is what a build tool ships when nobody told it otherwise, usually so that a preview address and a live address both work while you are building, and it survives into production because nothing in your app breaks when it is too wide. What decides how much it matters is whether the address behind it needs a login. One that answers anybody is the version to fix this week.",{"q":301,"a":302},"I connected my own Supabase project to my Base44 app. Does that change things?","It changes the most important thing. Your own project answers the internet directly, so the per-table Row Level Security setting is now yours to get right, and it is off by default for any table created by running SQL. That is the one path where the classic open-database problem reaches a Base44 app, and it is worth ten minutes of your time.",[304,305,306,307,308],"is base44 safe","base44 app security","base44 cors","base44 api key exposed","base44 source maps",{},true,"\u002Fis-your-base44-app-safe","2026-08-30",{"title":5,"description":288},"is-your-base44-app-safe",[316,317,318],"Base44 does not expose your database to the internet. The mistake that leaks most vibe-coded apps is not available to you, and that is a real advantage.","The risk moves to what the browser can see: an API that answers any website, and your original code published beside the app. Those two are on nearly every Base44 app we scan.","Nobody can check a Base44 database from outside, us included. If you attached your own Supabase project, that part is checkable and worth checking.","pg7_fxRGa6-tFBNm6m-hqroai8B37GhzF1-7YvwlSsw",1788681836865]