BASE44DEVS

00 /SERVICE · BASE44 AUDIT

Know exactly what is wrong with your Base44 app.

For Base44 apps with real users, payments or private data.

Order the $497 auditBook a free 15-minute call

Short answer

Last reviewed · 2026-09-24

A Base44 audit from Base44Devs is a fixed-price $497 security and production review of your app, delivered one business day after access. A senior engineer walks 12 components across 110 individual pass/fail checks — auth surface, Row-Level Security, SDK call patterns, credit-burn rate, function routing, schema integrity, webhook reliability, performance, security disclosures (Wiz, July 2025; Imperva, August 2025), App Store readiness, Stripe integration, and migration cost projection — in approximately 340 minutes of scoped engineer time. Every finding carries a severity rating and reproduction steps, and the report closes with a prioritised remediation plan and a fix, rebuild or migrate verdict. The $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days.

01 /AUDIT SPEC

One report. Four review domains. One business day.

The audit is a productized scope: the same 110 checks and the same report shape for every app, so findings are comparable. Architecture, security, performance and SEO are reviewed in one pass. For why agent-written Base44 code tends to fail these checks, read the AI-builder audit guide.

TIER · RECOMMENDED

Production Audit

$497

USD · Fixed-price · One engagement

A senior engineer reviews your Base44 app end to end and delivers a severity-rated written report one business day after access.

Scope

  • 12 components · 110 pass/fail checks
  • Security: auth, RLS, SDK calls, Wiz / Imperva disclosures
  • Performance, SEO and credit-burn review
  • Stripe and webhook reliability
  • Severity rating + reproduction steps per finding
  • Prioritised remediation plan with a fix / rebuild / migrate verdict
  • 30-min walkthrough call (optional)
  • Fee credited in full against follow-on work booked within 30 days; refunded if we can't reproduce the bug you ordered it for

Out of scope

  • Implementation work (separate engagement)
  • Real-time pair-debugging
  • Penetration testing of the Base44 / Wix platform itself
Order the $497 audit

02 /SCOPE

Twelve components. 110 individual checks. Pass / Fail / N-A on every line.

Every audit ships against the same checklist so the report is comparable and complete. This list is the product specification: the canonical checklist applied to your app on day one.

FIG. 05 — AUDIT SPECIFICATION · REV. 2026-05

Audit checklist · v2026.05

Auth surface
12 checks · session expiry, OAuth callback validation, PKCE, logout state
RLS configuration
9 checks · rule coverage, privilege-escalation paths, anonymous surface
SDK call patterns
14 checks · entity calls, error handling, optimistic update safety
Credit-burn rate
8 checks · prompt patterns, cached/uncached ratio, projected monthly cost
Function routing
11 checks · 404s, latency tail, post-deploy regressions
Schema integrity
10 checks · referential integrity, anti-patterns, index coverage
Webhook reliability
7 checks · retries, idempotency, dead-letter handling
Performance benchmarks
9 checks · TTFB, LCP, INP, client render path, crawler prerender snapshot
Security disclosures
6 checks · Wiz (Jul 2025) + Imperva (Aug 2025) + post-acquisition deltas
App Store readiness
8 checks · StoreKit, privacy nutrition labels, ATT compliance
Stripe integration
10 checks · webhook signatures, idempotency, refund/dispute paths
Migration projection
6 checks · table count, route count, cost-of-stay vs cost-of-leave

Total · 12 components · ~340 minutes scoped time · 110 individual checks

03 /PROCESS

From access to report in one business day.

Six steps, in this order, on every audit. The four review blocks add up to the 110 checks. Apps with 15+ tables or several integrations may take a second day; you hear that when you book.

  1. STEP 01

    Order the audit

    Pay the $497 fee and grant read-only collaborator access (or schedule a screen-share). The audit clock starts at the next business day.

  2. STEP 02

    Auth, RLS, and SDK review (35 checks)

    We walk the auth surface (12 checks), Row-Level Security configuration (9 checks), and SDK call patterns (14 checks). Findings include reproduction steps for any privilege-escalation paths.

  3. STEP 03

    Credit-burn, routing, and schema (29 checks)

    We measure credit-burn rate against active workflows (8 checks), test function routing health (11 checks), and validate schema integrity (10 checks).

  4. STEP 04

    Webhooks, performance, and Stripe (26 checks)

    We verify webhook reliability (7 checks), run performance benchmarks (9 checks), and audit the Stripe integration end-to-end (10 checks).

  5. STEP 05

    Security disclosures, App Store, and migration projection (20 checks)

    We confirm the Wiz (July 2025) and Imperva (August 2025) disclosures are remediated (6 checks), assess App Store readiness (8 checks), and produce a migration cost projection (6 checks) so you have an off-ramp option.

  6. STEP 06

    Receive the written PDF report

    Delivered before close of the next business day. Findings are ranked by severity (critical / high / medium) with reproduction steps, a prioritised remediation plan and a fix, rebuild or migrate verdict.

04 /SAMPLE FINDING

What a single audit finding looks like.

An illustrative finding in the report's exact format: header, issue, reproduction, fix, effort. The entity is generic; the rule syntax is Base44's documented entity rls block (docs.base44.com, read 23 Sep 2026). Severity is ranked critical / high / medium so remediation can be prioritised.

FINDING #04 · COMPONENT: RLS CONFIGURATION

SEVERITY · HIGH

The Order entity lets every user read every order.

Issue
The entity's rls block sets "read": true, which Base44 documents as “allow all users”. Updates are owner-only, so the app looks locked down while any user can list the whole table.
Reproduction
Sign in as a second, non-admin test user and call base44.entities.Order.list(). It returns orders created by other users.
Fix
Replace the read rule with created_by = {{user.email}}, joined by $or to an admin role check, and deploy the schema. Re-run the reproduction: the test user gets their own orders only. Backend functions that read orders through base44.asServiceRole skip these rules entirely, so each one is listed for its own access check.
Effort
Estimate ~2 hours · one schema change · regression test included.

Illustrative: generic entity, Base44's documented rule syntax. Real client names, table names and data volumes are never published.

05 /SAMPLE REPORT

What the written report contains.

Every PDF follows one outline. The worked finding below is built only from a public security disclosure, so nothing in this section comes from a client engagement.

SAMPLE FORMAT — not a client report

The six sections of a Base44Devs audit report and what each one contains.
§SectionWhat it contains
01VerdictFix, rebuild or migrate — and the findings that decide it.
02Severity summaryFindings per severity for each of the 12 components.
03FindingsOne entry per failed check: component, severity, issue, reproduction steps, remediation, effort.
04Check logAll 110 checks marked Pass, Fail or N-A.
05Remediation planFindings ordered by severity and effort: what you can fix, what a sprint covers, what needs a rebuild.
06Migration projectionTable count, route count, cost-of-stay vs cost-of-leave.

  • SEVERITY · Critical

    Data or account access reachable now, by anyone. Fixed before anything else.

  • SEVERITY · High

    Exploitable by a signed-in user, or breaks a payment or auth path. Fixed in the next sprint.

  • SEVERITY · Medium

    Costs credits, speed or reliability without exposing data. Scheduled.

SAMPLE FORMAT — not a client report · WORKED FINDING · COMPONENT: SECURITY DISCLOSURES

SEVERITY · CRITICAL (AS RATED BY WIZ)

An SSO-only app let outsiders register with nothing but its public app_id.

Issue
Two undocumented auth endpoints, register and verify-otp, accepted an app's app_id without authentication. Wiz found that value in every app's manifest path, so an outsider could create a verified account on a private app and sign in past its SSO.
Reproduction
Recorded as Wiz Research published it. Wiz verified the platform fix, so a report today logs a re-test (an external registration on the private app is refused), not a working exploit.
Remediation
Platform: reported 9 Jul 2025, fixed by Wix within 24 hours, fix verified by Wiz on 10 Jul 2025. App: check the app's analytics for unusual visits and registrations on or before 9 Jul 2025, as Wiz advises.
Source
Wiz Research disclosure, published 29 Jul 2025 (read 23 Sep 2026).

06 /VS. BUILT-IN DIAGNOSTICS

How a Base44Devs audit compares with Base44’s diagnostics and Security Scan.

Base44’s Security Scan runs on every plan, including Free. It checks seven issue types and applies no fix until you review it; Security Center runs the same scan across up to 20 apps at a time on Enterprise. Base44’s own launch post (16 June 2026) is plain about the limit: “Security Scan is not promising your app is secure.”

Run the scan first. The audit starts where it stops: the engineer walks the components outside the scan’s published checks — credit-burn rate, Stripe and webhook reliability, schema integrity, performance, App Store readiness and migration cost — and every finding ships with reproduction steps in a prioritised remediation plan. For how each web-security risk shows up on the platform, read the OWASP Top 10 in Base44.

Base44's Security Scan compared with the Base44Devs audit, area by area.
Data permissions (RLS)Base44 Security ScanFlags tables missing permission rules, or granting more access than they should, with recommended rules.Base44Devs auditRLS configuration, 9 checks: rule coverage, privilege-escalation paths, anonymous surface, with reproduction steps.
Backend functionsBase44 Security ScanFlags functions anyone can run without signing in.Base44Devs auditFunction routing, 11 checks: 404s, latency tail, post-deploy regressions.
CreditsBase44 Security ScanFlags credit-using features that can be reached from outside the app.Base44Devs auditCredit-burn rate, 8 checks: prompt patterns, cached/uncached ratio, projected monthly cost.
Secrets, dependencies, code, headersBase44 Security ScanExposed secrets, vulnerable packages, security headers; code vulnerabilities on the Builder plan and above.Base44Devs auditOutside the 12 components. Run the scan and act on what it flags first.
Payments and webhooksBase44 Security ScanNot among the seven published issue types.Base44Devs auditStripe integration (10) and webhook reliability (7): signatures, idempotency, retries, refund and dispute paths.
Schema, performance, App Store, migrationBase44 Security ScanNot among the seven published issue types.Base44Devs auditSchema integrity (10), performance (9), App Store readiness (8), migration projection (6).
OutputBase44 Security ScanAn issue list with recommended fixes; nothing is applied until you review it.Base44Devs auditA written PDF: severity, reproduction steps, remediation plan and a fix, rebuild or migrate verdict.
PriceBase44 Security ScanIncluded on every plan, including Free.Base44Devs audit$497 fixed, credited against follow-on work booked within 30 days.

Source · docs.base44.com security-scan page · base44.com/blog, 16 Jun + 6 Aug 2026 · read 23 Sep 2026

07 /AUDIT TO FIX

What happens after the audit.

The $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days. If you ordered the audit for a specific bug and we cannot reproduce it, we refund the fee; otherwise it is non-refundable. Four paths follow the report.

PATH 01

You implement the fixes yourself.

Reproduction steps and remediation plan are written for any competent engineer. We do not lock the work to us.

PATH 02

Bug-fix sprint — $1,500 · 48–72h.

One high-impact issue from the report. Starts within 48 hours; ships 48–72 hours after kickoff. Money-back if the sprint cannot resolve the issue, including a Base44 platform bug with no workaround. If a Base44 update breaks the fix within 90 days, we re-fix it at no charge. How the fix sprint works →

PATH 03

Multi-bug rescue — $3,000 · 1–2 weeks.

3–8 related defects from the report, with the priority list agreed in writing. Any agreed defect we cannot resolve is refunded pro rata. Every fix carries the 90-day fix hold.

PATH 04

Migration — from $6,000.

When the verdict is migrate, the report's migration projection becomes the starting scope. Your Base44 app stays online during the move, with a 14-day rollback window and a 30-day defects warranty. How a Base44 migration runs →

08 /FAQ

Frequently asked questions

Q.01What does a Base44 audit check?
A.01

A Base44Devs audit checks 12 components across 110 individual pass/fail checks: auth surface (12 checks — session expiry, OAuth callback validation, PKCE, logout state), Row-Level Security configuration (9 checks — rule coverage, privilege-escalation paths, anonymous surface), SDK call patterns (14 checks), credit-burn rate analysis (8 checks — prompt patterns, cached/uncached ratio, projected monthly cost), function routing health (11 checks), schema integrity (10 checks), webhook reliability (7 checks), performance benchmarks (9 checks), security disclosures applied (6 checks — Wiz July 2025, Imperva August 2025), App Store readiness (8 checks), Stripe integration (10 checks), and migration cost projection (6 checks). Total scoped engineer time is approximately 340 minutes.

Q.02How is the audit delivered?
A.02

A written PDF report: every finding carries a severity rating (critical / high / medium) and reproduction steps, and the report closes with a prioritised remediation plan and a fix, rebuild or migrate verdict. A 30-minute walkthrough call is included if you want one. Reports follow the same canonical specification (rev. 2026-05) so findings are comparable across apps.

Q.03Do you need access to our Base44 workspace?
A.03

Read-only collaborator access is ideal — we do not need write access for an audit. We can also work from a screen-share if your security policy prohibits external access. We never log in to third-party services on your behalf during the audit.

Q.04Is the audit fee refundable?
A.04

The $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days. If you ordered the audit for a specific bug and we cannot reproduce it, we refund the fee; otherwise it is non-refundable. Fix sprints booked afterwards carry their own guarantee: Money-back if the sprint cannot resolve the issue, including a Base44 platform bug with no workaround. If a Base44 update breaks the fix within 90 days, we re-fix it at no charge.

Q.05How long does a Base44 audit take?
A.05

One business day from the time we have access. Larger apps (15+ tables, multiple integrations, complex auth) may extend to two days; we tell you up front during scheduling. The audit report is delivered as a written PDF before the close of the next business day.

Q.06Is Base44's built-in security scan enough?
A.06

It is enough to catch common access-control and dependency gaps, not to vouch for a production app — so run it first. Security Scan, available on every plan including Free, checks seven issue types: data permissions, exposed secrets, unauthenticated backend functions, credit protection, app dependencies, code vulnerabilities (Builder plan and above) and security headers, and it applies no fix until you review it. Security Center runs the scan across up to 20 apps at a time on Enterprise. Base44's own launch post (base44.com/blog/base44-app-review, 16 June 2026) says: 'Security Scan is not promising your app is secure.' The Base44Devs audit walks the components outside the scan's published checks: credit-burn rate, Stripe and webhook reliability, schema integrity, performance, App Store readiness and migration cost projection. Every finding ships with reproduction steps in a prioritised remediation plan.

Q.07How does this compare to a freelancer reviewing my app?
A.07

A freelance review is as thorough as the reviewer, and its scope is whatever they choose to check. The productized audit applies the same 110-check specification to every app, ships a written PDF with reproduction steps, and the $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days. The format is repeatable, comparable across apps, and grounded in the published security disclosures (Wiz, July 2025; Imperva, August 2025).

Q.08What happens after the audit?
A.08

You receive the report and (optionally) a 30-minute walkthrough. You can implement the remediations yourself, hire us for a $1,500 fix sprint (one high-impact issue) or a $3,000 multi-bug rescue (3–8 related defects), book a migration from $6,000, or use the report as a scoping document with another engineer. The $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days.

09 /NEXT STEP

Get the report on your desk tomorrow.

Grant access today and the report lands one business day later (two for apps with 15+ tables or several integrations). The $497 fee is credited in full against any fix, build, migration or written-recommendation engagement booked within 30 days.

Order the $497 auditBook a free 15-minute call