Is my Base44 app safe to launch?

What Base44 already does for you

• Base44 has a built-in security scan on every plan, including free: Dashboard → Security → Run Security Scan. It checks data permissions, exposed secrets and vulnerable code, and offers a one-click fix for each finding.
• When you publish, the publish panel shows your app's security status. It warns you rather than stopping you, so a green publish button doesn't mean the scan is clean.
• Each table has its own create, read, update and delete permissions. Tables with a risk get a warning icon and a "Permission risks detected" banner on the Data page.
• Keys for outside services belong on the Secrets page and are used by backend functions, which run on the server. Backend functions need a Builder plan or higher.

Base44's scan looks at your app from the inside, and you should run it first. Throttle Bird looks at your published site from the outside, the way a stranger's browser sees it: what got shipped to the page and its JavaScript, which headers your site sends, HTTPS, link previews and whether Google can find you. It doesn't test Base44's table permissions directly, so the permission checks below are still yours to do.

6 checks before you share the link

1. 1. Every table only shows people their own records

   Why it matters: If a table is set so all users can read it, anyone using your app can read every record in it.

   How to check: Open Dashboard → Data, pick a table, click Permissions, and ask for each action: who should really be able to do this? For private data the answer is usually the record's creator plus admins.

   Fix prompt to paste into Base44

   Copy prompt

   Review the permissions on every data table. For private data, only the record's creator and admins should be able to read, update, or delete it. Tell me which tables are readable by all users and whether that's intended, before changing anything public.

2. 2. No access rule trusts a field users can edit

   Why it matters: Users can edit custom fields on their own profile. If a rule relies on one, like a company field that decides which records someone sees, a user could change it and get someone else's access.

   How to check: Base44's scan lists these under User fields users can change. Apply the fix, then test any signup or onboarding step that sets the field.

   Fix prompt to paste into Base44

   Copy prompt

   List every access rule that depends on a field in the user's profile. For each one, make sure regular users can't change that field themselves; only admins or the app's own backend should set it.

3. 3. You've tested as a second person

   Why it matters: Permission rules are easy to misread. Seeing what another account can reach is the only way to be sure.

   How to check: Use Test Permissions in preview from a table's More actions menu. Then open the live app in a private window, sign up as a new person, and try to find the first person's records, including by changing an ID in the address bar.

   Fix prompt to paste into Base44

   Copy prompt

   Walk me through what a brand-new signed-in user can see on every page, and what a logged-out visitor can see. Flag anything that shows another person's records.

4. 4. Keys live in Secrets, not in the chat or the code

   Why it matters: Anything in your app's frontend can be copied by anyone who opens it. A leaked OpenAI or Stripe secret key can run up a real bill.

   How to check: Open Dashboard → Secrets and make sure each outside service's key is there and used only by backend functions. If a secret key was ever in frontend code, make a new one in that service's dashboard and delete the old one.

   Fix prompt to paste into Base44

   Copy prompt

   Check whether any secret API key (OpenAI, Stripe secret key, email provider) appears in frontend code. Move every secret into Secrets and use it only from backend functions, so no secret reaches the browser.

5. 5. Lookup pages still work after the fixes

   Why it matters: Base44's docs note that a permissions fix can break a page where visitors look something up without logging in, like a booking.

   How to check: After applying fixes, open each public page in a private window and use it the way a visitor would.

   Fix prompt to paste into Base44

   Copy prompt

   After the permission changes, check every page that logged-out visitors use. If one stopped working, make it read only the fields it needs, without opening the whole table to everyone.

6. 6. Your link looks right when shared

   Why it matters: Your first users come from links in chats and posts. A blank preview with no title looks unfinished, and an app with no sitemap is harder for Google to find.

   How to check: Text your link to yourself and look at the preview. Then run the free scan to check the title, description, sitemap and security headers.

   Fix prompt to paste into Base44

   Copy prompt

   Give every page a unique title and meta description, and add Open Graph tags with a 1200x630 share image so my link shows a proper preview in messages and social posts.

What the free scan checks on your live Base44 app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• Missing security headers that block injected scripts and click-jacking.
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your Base44 project, so it doesn't replace testing sign-up and payments yourself.

Scan my Base44 app free

Questions

Base44 already scans my app. Do I still need this?

Run Base44's scan first; it's the only one that can see your table permissions. Throttle Bird is a second look from the outside, at what your live site actually sends to visitors, like keys in the page and missing security headers.

Can I scan a base44.app link?

Yes, as long as it's publicly reachable. Your published base44.app address or your custom domain both work.

Does the scan change anything in my Base44 app?

No. It only reads your public site. It never logs in, submits forms, or writes data.