# Base44 Security: What Our Independent Pentest Found > Source: > Published: 2026-11-03 10:59:11+00:00 Base44 turns a plain-English prompt into a working app with login, a database, and hosting included. That speed is why so many founders look into Base44 security before they put real users on it. We pentested one Base44 app to find out, and this piece covers the same. We gave 4 AI coding platforms the same security-explicit prompt, then attacked each app. This article covers what we found in the Base44 app and what it means for yours. ## **How did we** test it? We asked each platform to build an admin dashboard with four user roles, audit logging, and SSO. [Autonomous pentesting](https://www.getastra.com/autonomous-pentesting) agents then attacked each running app from an outside attacker’s view, and a Validator agent re-ran every exploit. A security engineer reviewed each finding, and we dropped anything we couldn’t reproduce. Testing ran in Q2 2026. ## **What did the pentest find in the Base44 app**? The Critical issues clustered in authentication and authorization: - Unauthenticated entity creation with role assignment - Audit log tampering and deletion - Unauthenticated admin invitation forgery - Unauthenticated password change Our prompt required authentication on every endpoint by default. An attacker still needed zero logins to forge admin invitations, delete audit logs, and change another user’s password. We also found IDOR across multiple entities, API tokens stored in a reversibly encoded form, and a 90-day token lifetime. ## **Vibe-Coding security vulnerability: what Wiz Research found earlier** Our results aren’t the first security concerns being reported. In July 2025, [Wiz Research](https://www.wiz.io/blog/critical-vulnerability-base44) reported that anyone could register for private Base44 apps using only a non-secret app ID. Wix, which owns Base44, fixed the flaw within 24 hours and found no evidence of exploitation. That was a different bug from ours, but the theme repeats: authentication is where AI-built apps break first. ## **Read these results fairly** So is Base44 safe? Not without testing. We tested one app, built from one prompt, in Q2 2026, and as platforms update often, your app may differ. **We didn’t set out to rank platforms, and we aren’t arguing against using Base44.** We’re arguing for the vulnerabilities associated with vibe-coding and how you simply can’t prompt your way out of this.  Security requires dedicated human oversight beyond just basic automated checks. ## **Check your Base44 app in 5 minutes** Run these checks before you launch: - Open an entity endpoint such as /api/apps/…/entities/Profile with no session. It should return 401, not data. - Try changing another user’s password without logging in as them. It should fail. - Delete a record, then try deleting its audit log entry. The log should be append-only. - Add “role”: “admin” when you create or update your own profile. The app should ignore or reject it. - Request another user’s record by ID. You should get a block, not the record. Base44 security can shift every time you prompt a change, so re-run these checks after every major change. [Autonomous pentesting](https://www.getastra.com/autonomous-pentesting) repeats these attacks automatically after each release. The full report includes the complete Base44 checklist and a corrected security prompt; [download it here](https://www.getastra.com/vibe-coding-security-report). ## FAQs ### **Is Base44 safe?** In our test, the Base44 app surfaced 30 confirmed vulnerabilities, including 13 critical authentication and authorization issues. Results from one app don’t settle the question for the platform, but they’re a good prompt to verify your own build. ### **What are Base44 security concerns?** One major concern is authentication and access control. Our pentest found unauthenticated admin invitations, password changes, and audit log deletion, plus IDOR across entities and 90-day tokens. ### **How to secure the Base44 app?** Name every public route, require authentication everywhere else, shorten token lifetimes, and make audit logs append-only. Then test each rule from outside your app.