How to Secure Your Base44 App

1. Extract Secrets from Generated Code

Base44's prompt-to-code generation embeds API keys directly in frontend files. Search every generated file for credentials and move them to server-side environment variables.

grep -r 'sk-' . # OpenAI keys
grep -r 'sk_live\|sk_test' . # Stripe keys
grep -r 'api_key\|apiKey\|API_KEY' . # Other API keys
grep -r 'password\|secret\|token' . # Other credentials

2. Create Server-Side API Proxies

Instead of calling third-party APIs from the frontend with exposed keys, create server-side proxy endpoints that hold the credentials securely.

// Instead of calling OpenAI from the browser:
// BAD: fetch('https://api.openai.com/v1/...', { headers: { Authorization: 'Bearer sk-...' } })

// Create a server endpoint:
// GOOD: fetch('/api/generate', { method: 'POST', body: JSON.stringify({ prompt }) })

3. Add Authorization to Every API Route

Generated endpoints often check if a user is logged in but don't verify they own the requested resource. Add user ownership checks to every database query.

// BAD: returns any user's data
const data = await db.select().from(orders).where(eq(orders.id, req.params.id));

// GOOD: only returns the authenticated user's data
const data = await db.select().from(orders)
  .where(and(eq(orders.id, req.params.id), eq(orders.userId, session.userId)));

4. Harden Authentication Flows

Add rate limiting to login endpoints, implement account lockout after failed attempts, and verify password hashing uses bcrypt or argon2 — not plain text or weak hashing.

// Add rate limiting to auth endpoints
import rateLimit from 'express-rate-limit';

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts per window
  message: 'Too many login attempts'
});

app.post('/api/login', authLimiter, loginHandler);

5. Add Input Validation to Endpoints

Generated code typically trusts user input. Add schema validation to every API endpoint that accepts data.

import { z } from 'zod';

const createOrderSchema = z.object({
  productId: z.string().uuid(),
  quantity: z.number().int().positive().max(100),
  shippingAddress: z.string().min(10).max(500),
});

// Validate before processing
const validated = createOrderSchema.parse(req.body);

6. Configure Security Headers and Scan

Add CSP, HSTS, and X-Frame-Options through your hosting platform. Then run VAS on the deployed app to catch anything you missed.