Base44 is a legitimate platform and its shared backend is not inherently unsafe. The risk is per-app configuration: whether your app's data (its entities) can be read without logging in. In our scan of 8,003 Base44 apps, almost 1 in 3 had a critical or high-severity issue, most often data readable without authentication.

Can someone read my Base44 app's data without logging in?

If your entities are not protected by the right access rules, yes. Base44 routes every app through a shared backend addressed by a public app_id, so an app with open entities can return its records to anyone who asks. This is broken access control, and it is the most common serious issue we see in Base44 apps.

Do I need to give you access to scan my Base44 app?

No. You give us your app's URL and we check it passively from the outside, reading only what the app already exposes publicly. We never log in and never change anything.

Base44 security

Is your Base44 app exposing data?

Q: Has Base44 had a security incident?

Yes. In July 2025, Wiz Research disclosed a critical authentication bypass in Base44 that let anyone register into private apps using only the public app_id. Wix patched it within 24 hours. It shows why independently checking your own app's access controls matters.

Reviewed by Xavi Beltran · Updated September 2026

Base44 lets you ship a real, data-backed app from a prompt â fast. But most security advice about "AI builders" doesn't actually apply to Base44, because Base44 works differently. Here's the risk that does apply, what our own scans found, and how to check your app in about ten seconds.

Check your Base44 app now

Paste your app's URL. The free scan reads it from the outside and checks entity access, authentication and secrets. No signup, nothing changed.

Only scan apps you own or have permission for.

The short answer

Base44 is a legitimate platform (now part of Wix), and its backend is not inherently unsafe. The risk is per-app configuration â and specifically whether your app's data can be read without logging in. That's different from other builders, where the classic problem is a secret key leaking into the frontend. In Base44, keys are rarely the issue. Access control is.

Almost 1 in 3

We ran our scanner against 8,003 publicly-reachable Base44 apps. About 30% (2,409) had a critical or high-severity issue â most often data readable without authentication.

Based on Base44 apps we could reach and scan passively (read-only) from the outside, as of September 2026. Aggregate figures only; no individual app is identified.

High / critical 2,409 · 89%
Medium 308 · 11%
Low 1 · <1%

Severity of the apps we flagged, grouped by their most serious issue (critical counted as high). Passive, read-only scans of publicly-reachable apps, September 2026.

Why Base44's risk is different

Most AI builders wire your app directly to a backend like Supabase or Firebase, so their classic failure is a secret key ending up in the browser. Base44 doesn't work that way. Every Base44 app talks to a shared backend (app.base44.com), and your app is addressed by a public app_id that appears right in the URL. Because the backend is shared and the id is public, there are no per-app database keys to leak.

Instead, your data lives as entities (think tables) on that shared backend, and security comes down to who is allowed to read each entity. If an entity isn't locked down to authenticated users, anyone who knows your app_id â which is public â can ask the backend for its records and get them back. That's broken access control, and it's the issue behind almost every serious finding in our Base44 scans.

Real incident

In July 2025, Wiz Research disclosed a critical authentication bypass in Base44: anyone could register into private apps using only the public app_id, reaching internal chatbots, knowledge bases and HR/PII tools. Wix patched it within 24 hours (coverage). The platform fix is done â but it's a reminder that your app's own access controls are worth checking independently.

What can go wrong in a Base44 app

Data

Entities readable without login

The big one. An entity that holds user data but isn't restricted to authenticated users returns its records to anyone with your public app_id. This is the most common critical issue we find.

Access

Weak authentication / permissions

Auth that can be bypassed, or roles and permissions that let the wrong user read or write records they shouldn't.

Money

Secrets in custom code

Rarer on Base44, but if you added custom functions or integrations, a secret key (an AI or payment key) can still slip into something public.

Minor

Missing browser protections

Security headers that harden the app against tricks like clickjacking. Minor, but easy to close once the big items are handled.

How to check your Base44 app

The honest version: checking access control by hand is fiddly. You'd need to identify your app's entities and test whether each one returns data to an unauthenticated request â and it's easy to miss one. The reliable way is an automated check from the outside:

List the entities your app relies on and note which hold real user data.
Confirm each one refuses to return records without a valid login.
Or just run the free scan below and let it check entity access, auth and secrets for you.

Is your Base44 app one of the 30%?

Find out in about 10 seconds. Free, no signup, read-only.