Base44

Security scan for Base44 apps

Base44 generates full-stack applications with the data layer wired up for you. As with every generator in this category, the code that gets written is only as locked down as the access rules you configure afterwards.

A passive scan tells you what the generated app is currently handing to anyone who visits it, which is the fastest way to find out whether the defaults were safe.

Scan your app

Or run it yourself

$pip install overshare
$overshare https://myapp.base44.app --fail-on high

What usually turns up on Base44 apps

Credentials in the shipped bundle

Generated data-layer wiring can reach for a privileged key rather than a scoped one.

Missing security headers

CSP, HSTS and nosniff are rarely configured by default on generated deployments.

Source maps published alongside the build

Default production builds often ship maps, which undo minification entirely.

What the scan actually does

It fetches your app the way any visitor's browser would, reads the JavaScript it ships, and checks the headers, certificate and DNS records that go with it. No login is attempted, nothing is modified, and no credential is used that was not already public.

See the full check list →