Security check: catch and fix data & backend risks in one click

Keeping your data secure doesn’t have to be complicated. With our security scanner, Base44 helps you spot hidden security risks in your app before they become a problem.

About our security check feature:

When you run a scan, Base44 checks your app for common security issues.

Click on each security issue below to learn more:

Public data access (RLS issues)

Some data should only be seen by the right people. When you run the scan, it checks each of your data entities (like Tasks or Comments) to make sure users don’t have more access than they should.

If your app allows everyone to view or edit certain data, the scan will show:

❗ All users have full access
⚠️ RLS Recommendation – Apply Fixes

Click Apply Fixes to use our recommended security rules. For example:

• Only the record creator can view or edit it
• Access is limited to specific users based on their email, role, or department
• Only admins can make changes

Clicking Apply Fixes updates your entity’s security settings based on our safe, recommended defaults. You can always review or change them later.

Want to learn more about how access rules work? See the full guide on managing security settings

Exposed secrets

Our security check also looks for things like:

• API keys
• Tokens
• Sensitive credentials

If it finds any of these in your frontend code, it will let you know so you can remove or move them to a secure place.

What is a secret? Secrets are private codes/ digital keys that help your app connect to other services. If someone gets access to a secret, they might be able to misuse your app or access data they shouldn’t.

How do I fix an exposed secret?

Fixing an exposed secret like an API key would require touching the code, because:

• You need to remove the key from your frontend code (which is written manually),
• And move the logic to a secure place, usually a backend function that you’ll either create or update.

You can paste the error and the code into Discuss mode to get step-by-step instructions from the AI. The AI can help write the code for the backend function and modify your frontend to call it.

Backend function issues

Backend functions are parts of your app that run behind the scenes such as handling payments or saving data. These should only be triggered in safe, controlled ways.

When you run the scan, it checks if any of your backend functions are:

• Open to anyone (when they shouldn’t be), or
• Set up in a way that doesn’t actually work

What is a check? Think of it like a security guard at a door. Before letting someone in, the guard makes sure they’re allowed, like checking a name on a guest list. In your app, a check does the same thing: it decides whether a request is safe and allowed before letting it through.

About unauthenticated backend functions
Security check flags backend functions that accept sensitive data (like emails, API keys, or IDs) without checking who the user is.

For example, a function that returns subscription details based only on an email in the request could accidentally expose another user’s info if someone changes the email in the request.

If a function is flagged, it usually means it’s trusting request data without verifying that the user is logged in or has permission to access it.

To fix this, you’ll want to add a quick check in the function to confirm:

• The user is signed in
• The request is for their own data

You can paste the error message and your function code into **Discuss mode **to get step-by-step instructions from the AI. The AI can walk you through how to add a quick check to verify the user is signed in, and make sure the request is for their own data.

How to access security check

There are two easy ways that you can access the security check feature.

Option 1: From your app menu

1. Click on your app menu
2. Select Security
3. Under Scan Issues click Start Security Check
4. Review any issues and click Apply Fixes

Option 2: From your dashboard

1. Go to your Dashboard
2. Click the Security tab
3. Under Scan Issues click Start Security Check
4. Review any issues and click Apply Fixes

Why it matters

The security check feature helps you:

• Prevent accidentally exposing private data
• Catch misconfigurations (like broken Stripe webhooks)
• Ship your app with more confidence knowing you’ve checked the essentials.

It also gives you clear instructions or lets you apply safe defaults with one click. It’s like having a security expert baked into your dashboard.

FAQ

Does the security check make any changes automatically?

No. It only highlights issues and offers one-click fixes. You choose when to apply them.

Will this affect users already using my app?

Changes to security rules can affect what users can see or do. We recommend reviewing any fix suggestions before applying them.

What if I don’t understand a warning?

Many recommendations come with a little dropdown arrow. Simply click it to see more details about what the issue is and why the fix is suggested. 

You can also copy the message into the AI chat (Discuss mode) to get a deeper explanation, step-by-step.

Still not sure? No problem! Just create a support ticket. Our team is always happy to help.

Can I add a video?

You can’t upload a video at this time, but you can link to one (like on YouTube, Vimeo, or Loom).