AI App Launch Audit · Fixed price, quoted up front
Base44 App Security Audit
Built your app on Base44? Before you invite customers, staff or partners in, our senior Brisbane-led team checks the parts Base44 leaves to you: who can read and change each record, how sign-in is set up, where your keys live, and what happens when someone uses the app in ways you didn’t plan for.
Fixed price, quoted up front
Free 30-minute engineer chat
Senior human review, not another scan
Findings in plain English
Fix it yourself or we fix it
Australian hosting available
Where Base44 apps go wrong
What goes wrong in Base44 apps before launch
Base44, owned by Wix, builds the front end, data, sign-in and hosting from a prompt. The platform secures its own infrastructure. The access rules for your app, and your data, are yours to get right.
Access rules that are too open
Base44 entities support row level and field level security. If an entity is readable by all users, or public, anyone who can reach the app can list every record in it.
Rules that combine more loosely than you think
In the dashboard, multiple rules for an operation are combined with OR logic. One broad rule added for testing can quietly cancel out every careful rule beside it.
Fields that should be hidden
Field level rules inherit from the entity unless you set them. Notes, pricing, internal flags or contact details can be readable even when the record itself should be.
Back-end functions with full access
Functions running as the service role bypass row and field security entirely. Each one has to do its own permission checks, and AI-written functions often don’t.
Internal apps treated as private by default
Plenty of Base44 apps are internal tools for HR, operations or knowledge bases. In 2025, Wiz found a platform flaw that let outsiders register on private apps. Wix fixed it within 24 hours. The lesson: test who can actually get in, rather than assuming.
Keys and integrations in the wrong place
Third-party API keys belong in back-end secrets, not in prompts, front-end code or entity data that users can read.
Untested sign-in and invite flows
Who can self-register, who gets invited, what a new user can see on day one, and what happens when someone leaves your business.
Lock-in you haven’t planned for
Know what you can export (code, data, users) and what depends on Base44’s back end, before your business relies on the app.
Shared responsibility
What Base44 secures, and what’s still on you
Base44 handles hosting, encryption and platform security, and it provides tools such as a security scan and a permissions tester. None of that can know which of your users should see which records. That part is business logic, and it’s where most real-world data leaks happen.
01
Platform: Base44’s job
Infrastructure, encryption, patching the platform and responding to platform vulnerabilities, as it did with the 2025 Wiz disclosure.
02
Your rules: your job
Row and field rules on every entity, who can sign up, what each role can see and do, and which back-end functions run with full access.
03
Your data: your obligation
If the app holds personal information, the Australian Privacy Principles expect you to take reasonable steps to protect it, whatever tool built it.
04
Our job: proving it works
We test your rules as each type of user and as an outsider, and show you exactly what each can and can’t reach.
Base44 pre-launch checklist
9 things to check before you launch a Base44 app
Every item is part of our Base44 audit, alongside the 100+ general checks in our AI App Launch Audit.
Check 01
No entity is public by accident
Review every entity. Public or “all users” read access should be a deliberate choice, not a default you kept.
Check 02
Creator-only where it matters
Records that belong to one customer or staff member should only be visible to them and the right admins.
Check 03
Sensitive fields locked down
Set field level rules for anything a normal user shouldn’t see, even on records they can open.
Check 04
Test as every role
Use Base44’s permissions tester, then sign in as each role and try to view, edit and delete other people’s records.
Check 05
Functions check permissions
Any back-end function using the service role must check who called it and what they’re allowed to do.
Check 06
Sign-up and offboarding match your intent
If the app is internal, outsiders can’t register or be auto-approved, and a removed user loses access straight away.
Check 07
Keys in back-end secrets
No API keys in prompts, front-end code or readable entity fields.
Check 08
Run the security scan
Run Base44’s built-in security scan and resolve warnings before publishing.
Check 09
Export plan in writing
Know how you’d get your data and users out if you ever needed to.
Base44’s scan and permissions tester are a useful first pass. They can’t tell whether your rules match the way your business works. That takes a person who understands both.
How we audit a Base44 app
How a Base44 audit works
Focused on data access first, because that’s where Base44 apps carry the most risk.
1. Access and roles
You add us as a collaborator and create test accounts for each role. We map every entity, field and function, and agree the price up front.
2. Rules review
We read every row and field rule, every back-end function and every integration, and compare them with how you say the app should behave.
3. Hands-on testing
We try to read, change and delete data we shouldn’t, as each role and as an outsider, and walk your key workflows as a real user.
4. Report and re-check
A ranked, plain-English report with fix steps or prompts for Base44’s AI. Once changes are made, we test again.
Pricing
What a Base44 audit costs
Fixed price, agreed before we start. No hourly meter running while we read your code.
Free consultation
$0
30 minutes
Tell an engineer what you’ve built and who it’s for. If it’s ready to launch, that’s the answer you’ll get.
- Talk to an engineer, not a sales rep
- Mutual NDA on request
- An honest view of whether you need an audit
Most popular
AI App Launch Audit
Scoped to your app
Quoted
ex. GST, fixed price
A senior review of your Base44 app’s access rules, functions, sign-in and integrations, with a ranked, plain-English report.
- Senior human review of code, configuration and data access
- Findings ranked by risk, in plain English
- Fix guidance or AI prompts for each issue
- A re-check once fixes are in
Fixes and launch
Quoted
only if you want us to
Prefer we fix what we find? We quote the work after the audit, so you can choose between doing it yourself, a split, or handing it over.
- Fix it yourself with our guidance
- Or our team fixes it for you
- Help getting live and monitored
Prices exclude GST. The final audit price depends on the size of the app and is agreed in writing before we start. Still building and want ongoing help instead? See the AI Build Partner, a separate monthly product.
Client stories
What our clients say
Bianca
OnSchedule
“Working with Code Squirrel has been a fantastic experience! Their team is not only incredibly skilled but also highly responsive and professional. They took the time to understand our requirements and delivered exceptional results.”
Emma
Fliit
“Code Squirrel effortlessly understood our requirements and delivered exceptional outcomes. We now have our systems integrated removing hours of data entry and improving our management reporting capabilities. The team are great to deal with, transparent, responsive and highly skilled.”
Built with something else?
Audits for every major AI app builder
The risks change with the platform. Each of these pages covers what goes wrong on that tool and what we check. Not sure where to start? Read our vibe-coded app launch checklist.
FAQ
Base44 app audit questions
Is Base44 secure?
Base44 secures its own platform and fixed the 2025 Wiz-reported flaw within a day. Whether your app is secure depends on your access rules, functions and sign-in settings, which only you can set. That’s what our audit checks.
Isn’t Base44’s security scan enough?
It’s a good start and worth running. A scanner can spot risky settings; it can’t know that your sales team shouldn’t see payroll records, or that contractors shouldn’t edit invoices. We test your rules against how your business actually works.
Our Base44 app is internal only. Do we still need an audit?
Internal apps often hold the most sensitive data: staff details, customer records and pricing. If the app holds personal or commercially sensitive information, it’s worth confirming that outsiders and the wrong staff can’t get in.
What access do you need?
Collaborator access to the app and a test account for each user role. We don’t need your real customer data, and we’ll sign a mutual NDA first.
How much does a Base44 audit cost?
The AI App Launch Audit is a fixed price, quoted for your app and agreed before we start. Any fixes are optional and quoted separately.
Can you help if we outgrow Base44?
Yes. If your app needs custom integrations, Australian hosting or features the platform can’t support, we can plan a move to custom software that you own outright.
Can you keep an eye on the app after launch?
Yes, through a separate product. If you're still prompting new features into your app with Base44, our AI Build Partner puts an engineer across it on a steady rhythm: they review what changed, build and fix alongside you, and release it to production monthly or fortnightly. Plans start at $1,800 a month ex. GST, with a three-month initial term and then month to month. The audit fee isn't credited against a plan; they're separate products for different needs.
Get your Base44 app checked by humans.
Book a free 30-minute chat. Tell us what the app does and who uses it, and we’ll tell you honestly whether it needs an audit before launch.
