Security

Scan an app for security problems and act on the findings with the Base44 Apps API

The Apps API is in beta. Its endpoints and responses may change.

These endpoints run a security scan on an app, read what it found, and act on the recommendations. See Running a security scan for the same feature in the Base44 online app editor.

Run and read a scan

A scan reads the app’s code, so it takes a while and runs in the background. Run security scan starts a scan, or returns the last scan when it still matches the app. Get security scan reads the latest scan without starting a new one. A scan’s findings go out of date when the app changes, so check the scan’s status before you act on them.

Scan findings

Findings come in groups, by what the scan looked at. To ignore a finding, send the finding_type that matches its group.

Group	finding_type	What it holds
rls_recommendations	rls	Entities whose row-level security is too open.
hardcoded_secrets	secret	Credentials written directly into the app’s code.
backend_functions	backend_function	Problems in the app’s backend functions.
open_backend_functions	open_backend_function	What each backend function can do, on an app that doesn’t require login. These replace backend_functions on such an app.
dependency_vulnerabilities	dependency	Known vulnerabilities in the app’s npm packages.
static_code_findings	static_code	Problems found by reading the app’s code.
header_recommendations	None	Gaps in the published app’s HTTP headers. These can’t be ignored.

Findings and fingerprints

Every finding, except a header recommendation, has a fingerprint. It’s a stable ID that stays the same across scans until what the finding flags changes, which is how Base44 recognizes the same finding in a later scan. Each type of finding has its own rule for when its fingerprint changes, and the rule is described on that type’s fingerprint field.

Act on findings

You can deal with a finding in three ways.

• Fix it: Fix RLS recommendations applies the recommended row-level security rules, and Update security headers changes the headers.
• Dismiss it: Dismiss RLS recommendation and Dismiss header recommendation remove a recommendation from the scan result without acting on it.
• Ignore it: Ignore security finding hides a finding without changing the app or the scan result. The ignore is tied to the finding’s fingerprint, so it ends when the fingerprint changes and the next scan drops it. Restore security finding ends an ignore sooner.

Core integration protection

Core integrations are Base44’s built-in integrations, such as sending email or calling a language model. By default, an app’s pages can call them directly. With core integration protection on, they can’t, and the calls have to come from the app’s backend functions instead. File uploads and signed file URLs aren’t affected.

The protection has one exception, based on who the app is open to. If only invited users or workspace members can open the app, its signed-in users can still call the integrations directly. If anyone can open the app, nobody can. A scan reports whether turning it on is safe in core_integration_recommendation, and Enable core integration protection turns it on. You can’t turn it off through the API.

Endpoints

Scan

• Run security scan: Scan the app, or return the last scan if it’s still current.
• Get security scan: Read the latest scan and whether it still reflects the app.

Recommendations

• Fix RLS recommendations: Apply the recommended row-level security rules to entities you name.
• Dismiss RLS recommendation: Remove one entity’s recommendation from the scan result.
• Update security headers: Change the app’s security header settings.
• Dismiss header recommendation: Hide one header recommendation without changing the headers.
• Enable core integration protection: Require calls to Base44’s built-in integrations to come from backend functions.

Ignore findings

• Ignore security finding: Keep one finding hidden across rescans.
• Restore security finding: Stop hiding an ignored finding.