We asked each platform to build an admin dashboard with four user roles, audit logging, and SSO. Autonomous pentesting<\/a> agents then attacked each running app from an outside attacker\u2019s view, and a Validator agent re-ran every exploit. A security engineer reviewed each finding, and we dropped anything we couldn\u2019t reproduce. Testing ran in Q2 2026.<\/p>\n\n\n\n The Critical issues clustered in authentication and authorization:<\/p>\n\n\n\n Our prompt required authentication on every endpoint by default. An attacker still needed zero logins to forge admin invitations, delete audit logs, and change another user\u2019s password.<\/p>\n\n\n\n We also found IDOR across multiple entities, API tokens stored in a reversibly encoded form, and a 90-day token lifetime.<\/p>\n\n\n\n Our results aren\u2019t the first security concerns being reported.<\/p>\n\n\n\n In July 2025, Wiz Research<\/a> reported that anyone could register for private Base44 apps using only a non-secret app ID. Wix, which owns Base44, fixed the flaw within 24 hours and found no evidence of exploitation.<\/p>\n\n\n\n That was a different bug from ours, but the theme repeats: authentication is where AI-built apps break first.<\/p>\n\n\n\n So is Base44 safe? Not without testing.<\/p>\n\n\n\n We tested one app, built from one prompt, in Q2 2026, and as platforms update often, your app may differ. <\/p>\n\n\n\n We didn\u2019t set out to rank platforms, and we aren\u2019t arguing against using Base44. <\/strong>We\u2019re arguing for the vulnerabilities associated with vibe-coding and how you simply can\u2019t prompt your way out of this.\u00a0 Security requires dedicated human oversight beyond just basic automated checks.<\/p>\n\n\n\n Run these checks before you launch:<\/p>\n\n\n\n Base44 security can shift every time you prompt a change, so re-run these checks after every major change.<\/p>\n\n\n\n Autonomous pentesting<\/a> repeats these attacks automatically after each release. The full report includes the complete Base44 checklist and a corrected security prompt; download it here<\/a>.<\/p>\n\n\n\n In our test, the Base44 app surfaced 30 confirmed vulnerabilities, including 13 critical authentication and authorization issues. Results from one app don\u2019t settle the question for the platform, but they\u2019re a good prompt to verify your own build.\u00a0<\/p>\n\n<\/div>\n<\/div>\n One major concern is authentication and access control. Our pentest found unauthenticated admin invitations, password changes, and audit log deletion, plus IDOR across entities and 90-day tokens.<\/p>\n\n<\/div>\n<\/div>\n Name every public route, require authentication everywhere else, shorten token lifetimes, and make audit logs append-only. Then test each rule from outside your app.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":" Base44 turns a plain-English prompt into a working app with login, a database, and hosting included. That speed is why so many founders look into Base44 security before they put real users on it. We pentested one Base44 app to find out, and this piece covers the same. We gave 4 AI coding platforms the … Read more<\/a><\/p>\n","protected":false},"author":111,"featured_media":49965,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[761],"tags":[],"class_list":["post-49963","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/111"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49963"}],"version-history":[{"count":2,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49963\/revisions"}],"predecessor-version":[{"id":49970,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49963\/revisions\/49970"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49965"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/span>What did the pentest find in the Base44 app<\/strong>?<\/span><\/h2>\n\n\n\n
![\"Severity](\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/7e6f4764-03-severity-breakdown.png\")
<\/figure>\n\n\n\n\n
<\/span>Vibe-Coding security vulnerability: what Wiz Research found earlier<\/strong><\/span><\/h2>\n\n\n\n
<\/span>Read these results fairly<\/strong><\/span><\/h2>\n\n\n\n
<\/span>Check your Base44 app in 5 minutes<\/strong><\/span><\/h2>\n\n\n\n
![\"Base44](\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/14b9a08c-base44-security-risk-checklist.png\")
<\/figure>\n\n\n\n\n
![\"Astra](\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/35631463-scr-20260420-ltjq.png\")
<\/figure>\n\n\n\n<\/span>FAQs<\/span><\/h2>\n\n\n
Is Base44 safe?<\/strong><\/h3>\n
What are Base44 security concerns?<\/strong><\/h3>\n
How to secure the Base44 app?<\/strong><\/h3>\n