Check Base44 security
Is your Base44 app production-ready?
Free, platform-independent scan built for Base44 apps. It checks the gaps typical for Base44 — access control, visible keys, GDPR — and delivers a traceable Go/Iterate/Stop verdict with versioned rule codes.
Scan your Base44 app for free nowTypical weaknesses in Base44 apps
Base44 bundles backend and database behind the app — record access rules, open endpoints and visible keys should be checked.
Rules the scan weights for Base44
Supabase service_role key in the client
Decodes JWTs in the bundle and reports the `service_role` claim, which bypasses RLS entirely.
RSC-SEC-015Database tables granted to the anon role
Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.
RSC-SEC-018Protected area guarded only in the browser
Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.
RSC-SEC-050Tables without Row Level Security
Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.
RSC-SEC-051RLS policy allows everyone
Finds policies with `using (true)` — RLS is on but has no effect.
RSC-PRV-001Google Fonts loaded at runtime
Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.
RSC-PRV-002US tracking without visible consent
Detects analytics and pixel scripts with third-country transfer in the shipped markup.
Frequently asked
- Is the scan free for Base44 apps?
- Yes. The external scan is completely free and anonymous — you only enter the URL of your Base44 app.
- Do you need access to my Base44 account?
- No. The scan only inspects what your app serves publicly. It goes deeper optionally via read-only repo access or after a domain proof — both strictly opt-in.