Can Base44 apps be hacked?

Base44-Specific Attack Vectors

These are the paths attackers actually take into Base44 applications — not a generic OWASP list, but what automated scanners and security researchers find when they look at Base44 apps specifically, given the stack (Supabase (Postgres + RLS) as the database):

1. **Exposed API Keys**: OpenAI, Stripe, and other secret keys embedded in frontend code. Attackers can extract these and abuse your API quotas or access sensitive services.

2. **Database Exposure**: Supabase or Firebase tables accessible without proper Row Level Security or Security Rules, allowing unauthorized data access.

3. **Missing Security Headers**: Lack of Content-Security-Policy, Strict-Transport-Security, and other headers leaves your app vulnerable to XSS and MITM attacks.

4. **Weak Authentication**: No password requirements, missing email verification, and lack of brute force protection on login endpoints.

5. **Source Map Exposure**: Production source maps revealing your entire application source code, including API endpoints and business logic.

**Supabase-Specific Risk**: Base44 apps typically ship with the public Supabase anon key embedded in frontend code. That is by design — but only works safely if Row Level Security is enabled on every table. Attackers routinely query Supabase endpoints directly using the anon key from your bundle. A single table without RLS is a full data leak.

Real-world example

Common to find OpenAI keys, database passwords, and OAuth secrets in AI-generated projects.

How these issues get discovered

This isn't targeted — automated scanners run across the entire internet looking for known patterns, and Base44 apps surface like everything else. Supabase URLs follow a predictable pattern (`*.supabase.co`), making Base44 apps easy to fingerprint. Once identified, the scanner probes the specific vulnerability classes listed above.

What a security scan of a Base44 app looks at

• **Secret Detection** — Scans JavaScript bundles for API keys, tokens, and credentials that should be server-side only.
• **Database Security** — Tests Supabase RLS policies or Firebase Security Rules to verify data is protected.
• **Security Headers** — Checks for essential HTTP security headers to prevent common attacks.
• **Auth Configuration** — Analyzes authentication implementation for weak passwords, session issues, and rate limiting.