This post tracks the user-visible side of the Wix acquisition — public review sentiment, security researcher disclosures, and operational incidents — rather than the deal mechanics and contract terms (those live in our companion deep-dive on what changed after the Wix acquisition). The headline observations from public sources: two major security disclosures were published in July and August 2025 (the Wiz SSO bypass, fixed within 24 hours of its report, and Imperva's stored XSS, fixed in stages from March 2025) but neither brought an architectural fix to the default-permissive trust model; G2 and Trustpilot review sentiment shifted from praising founder responsiveness to citing multi-week support silence; the AI agent's behavior moved toward larger regenerations and more frequent regressions; and a multi-hour platform-wide outage on February 3 2026 made the lack of a contractual uptime SLA on self-serve plans tangible. The brand is intact; the operational reality reported by users has shifted.
Why this matters
Acquisitions change platforms in predictable ways. Most users skip the post-acquisition due diligence, treat the platform as if nothing changed, and discover the changes one billing cycle or one outage at a time. This article is the user-side diligence: what public reviewers, security researchers, and the status page have surfaced since the deal closed, and what that implies for anyone running production apps on Base44 in 2026. For the deal mechanics, the change of contracting party in the Terms, the DPA and sub-processor list, the SLA position, and the pricing math, read our companion piece: Base44 after Wix acquisition — what changed in 2026. Written by the lead engineer at Base44Devs based on our own client engagements through the transition.
Sources used here are TechCrunch's original deal coverage, Product Hunt and G2 reviews from before and after the deal, the Base44 changelog, security researcher disclosures from Wiz and Imperva, the platform's status page, and our own client engagements during the transition.
Timeline
Pre-acquisition: late 2024 to June 2025
Base44 launched as a bootstrapped AI app builder in late 2024. The product gained rapid traction in the vibe-coding space, competing with Lovable, Bolt.new, and Replit's AI features. The founder owned it alone, but it was not a one-person team: TechCrunch reported that he "wasn't truly solo — he had eight employees, Wix confirmed."
Sentiment in this period was positive. Early reviews praised the speed, the AI agent's capability, and the founder's responsiveness. Pricing was simple, support was direct (the founder responded personally), and the platform's quirks were tolerated as the cost of an early-stage product.
June 18, 2025: acquisition announced
Wix announced the acquisition for $80 million cash. TechCrunch's headline framed it as "6-month-old, solo-owned vibe coder Base44 sells to Wix for $80M cash", and reported that the eight employees "will collectively receive $25 million of the $80 million as a 'retention' bonus." Wix's own release that day says "Wix acquired Base44" under the agreement and gives no separate closing date.
The narrative around the deal was strategic: Wix wanted exposure to AI-driven app construction to compete with Squarespace's AI features and the broader vibe-coding category. Base44's traction and small team made it an attractive bolt-on rather than a competitor to be ignored.
July–August 2025: security disclosures
On 29 July 2025, six weeks after the deal was announced, Wiz published a critical vulnerability disclosure about an SSO bypass affecting Base44. Wiz had reported it to Wix and Base44 on 9 July and verified the fix on 10 July. The vulnerability allowed any attacker to register a verified account on private SSO-only apps using only the app_id. Wiz wrote that "by providing only a non-secret app_id value to undocumented registration and email verification endpoints, an attacker could have created a verified account for private applications on their platform."
Imperva published its own write-up on 27 August 2025, covering flaws it had reported to Base44 in March 2025, before the deal: an open redirect in the login flow, stored XSS in the /apps-show/ endpoint, and the main platform JWT passed to user-built apps through the URL. On the XSS, Imperva wrote that the injected payload "had access to authentication tokens stored in the browser local storage, and other sensitive data." The JWT flaw reached further still: whoever captured that token could get into the victim's whole Base44 account, other apps included, not just the one app.
The SSO bypass was fixed within 24 hours of Wiz's report. Imperva's findings got partial fixes in March 2025, with additional fixes and architectural changes in progress in April 2025. The underlying class of vulnerabilities — default-permissive trust between authenticated users — was not structurally addressed and remains a concern as of May 2026.
August–November 2025: pricing adjustments
User reports on Product Hunt and Trustpilot started citing price increases and reduced credit allowances. The platform did not issue a public price-change announcement; users discovered the changes at billing time. Quote from a Product Hunt review: "You can't buy more credits unless you upgrade to an expensive tier plan."
An app that ran comfortably within its tier in mid-2025 could be over-tier by year-end. The paid-tier price list was not the cause: archived copies of the pricing page show the same prices and credit allowances for Starter through Elite in April 2025 as today. What tightened was the Free plan and how fast apps burned through credits; either way, running the same app got more expensive.
Late 2025: support response degradation
G2 and Trustpilot reviews began citing multi-week response times for support tickets. One representative quote: "Support ticket opened March 29 never received a single reply."
This is a common post-acquisition pattern. A small company's support function, where one person knew every customer's app, gets integrated into a larger company's ticketing pipeline. The institutional knowledge does not transfer cleanly. Customers who used to get same-day responses now wait weeks.
November 27, 2025: explicit limit changes
The platform shipped a documented 5,000-record-per-request limit, replacing whatever the previous (undocumented) limit was. This broke at least some apps that had been listing larger result sets without pagination. Adaptation was straightforward but unannounced before the change took effect.
January 8, 2026: workspace-level custom integrations
Base44's product changelog records an expansion of custom integrations, not a deprecation: "You can now create custom OpenAPI integrations at the workspace level." A workspace owner or admin on the Builder plan or higher imports an OpenAPI spec once, and any app in that workspace can call it without a backend function. Base44's integrations docs say the calls are proxied through its backend, "so secrets never reach the browser." An earlier version of this post said new custom integrations would stop being supported after March 1, 2026. We found no such deprecation in the changelog or the docs, and have withdrawn it.
February 3, 2026: platform-wide outage
A multi-hour platform-wide outage hit on February 3. Status.base44.com confirmed the outage; the post-mortem (if one was published internally) was not published externally. Base44 publishes no uptime SLA for self-serve plans; Enterprise customers get SLA commitments in their contract (base44.com/security). Users on the self-serve plans had no recourse beyond waiting.
This was the first widely-reported sustained outage post-acquisition. Earlier outages had been shorter or scoped. The February event made the missing self-serve SLA a tangible problem for production apps.
May 2026: where we are now
The acquisition is eleven months old. The product surface has changed in measurable ways. The team identity has shrunk in user-facing visibility. Roadmap communications are sparse. Status quo as of writing:
- Running the same app can cost more than it did in mid-2025. The price list is not where that comes from: our breakdown of how credit consumption changed after the deal shows paid-tier prices and allowances unchanged since April 2025, with integration credits now charged by action and model.
- Support response times measured in days to weeks rather than hours.
- AI agent behavior more aggressive on regeneration, more frequent on regressions.
- Security defaults still permissive, two major disclosures patched but not architecturally fixed.
- No uptime SLA below Enterprise; SLA commitments come only with an Enterprise contract.
- No HIPAA attestation published.
- SOC 2, updated 23 Sep 2026: Base44 states its platform holds SOC 2 Type II and ISO 27001 certification and is independently penetration-tested, with the SOC 2 report and a GDPR DPA available on request (base44.com/security). That covers Base44's own controls; it does not attest your app's configuration (row-level security, secrets, auth rules), which a security questionnaire will still ask about.
- Custom OpenAPI integrations still supported, and shareable across a workspace since 8 January 2026.
What stayed the same
Not everything changed. To be balanced:
The AI agent still ships fast. The core value proposition — "describe an app, get a working app in minutes" — still works for prototypes. The speed-to-first-prototype is unchanged or better.
The IDE remained stable. The development environment, the agent UI, the entity editor, the deployment flow all look and work like they did in early 2025. No major UX overhauls.
The brand stayed visible. Despite Wix ownership, the Base44 name, domain, and product identity are intact. There has been no rebrand, no merge into a Wix subdomain.
The pricing structure stayed similar. Subscription tiers with credit allowances, GitHub integration gated behind the Builder plan on both the April 2025 pricing page and today's, same general shape. The changes are within the structure, not to it.
Custom domains still work. Custom domains, a Builder feature in April 2025, now come with the Starter plan ("Connect a domain"); SSL is still automatic, DNS instructions are unchanged.
What users complain about now vs. before
A loose comparison from public review trends:
| Complaint category | Pre-acquisition (2024–early 2025) | Post-acquisition (mid 2025–2026) |
|---|---|---|
| AI agent regressions | Common, but founder responsive | Common, no clear escalation path |
| Pricing | Considered fair | Considered expensive |
| Support response | Hours to days | Days to never |
| Stability | Bursty quality | Sustained outage Feb 2026 |
| Security | Imperva's findings reported privately (March 2025) | Wiz (July 2025) and Imperva (August 2025) disclosures published |
| Code export | Beta but improving | Still beta, no clear ETA |
| Roadmap clarity | Founder-driven, transparent | Corporate, opaque |
This pattern is consistent with what happens when a small founder-led company is acquired by a larger one. It is not a moral judgment of either party. It is the realistic operational shift.
Implications for current users
If you are running a production app on Base44 today, the acquisition shifts your risk profile in three ways.
Roadmap risk increased. Wix's strategic interests now drive Base44's roadmap. If Wix's primary customer (SMB website builders) doesn't share your needs (developer tooling, production apps, regulated workloads), your needs may be deprioritized. The Wix store management that arrived in the app editor on 25 August 2026 and the Wix font catalog added to the font pickers on 7 September 2026 show which way the roadmap leans.
Pricing risk increased. Wix is a public company with quarterly earnings expectations. Pricing power on Base44 is now subject to Wix's quarterly pressures, not just the founder's intuition. Plan for further changes to pricing and credit consumption.
Support risk increased. Larger company, less responsive support. Treat platform support as advisory, not load-bearing. Build your own runbooks for everything you might need to fix.
Implications for prospective users
If you are evaluating Base44 in 2026, the post-acquisition state is the relevant baseline. The romantic version of the platform — solo founder, tight feedback loop, clean security — is no longer current.
This does not mean don't use Base44. It means use Base44 with eyes open about the post-acquisition reality:
- Treat support as nonexistent for response time planning.
- Budget 25% headroom on subscription costs.
- Unless an Enterprise contract gives you SLA terms, assume uptime is best effort and plan for outages.
- Harden security manually because the platform's defaults are still permissive.
- Maintain a documented exit plan from day one.
If those compromises work for your app, the platform still ships value. If they don't, look at alternatives — we cover the migration paths in our migration playbooks.
What we don't know
To be honest about the gaps in this analysis:
- Wix has not published Base44-specific revenue or growth numbers, so we don't know the platform's commercial trajectory.
- The internal team size and composition under Wix is not publicly known.
- The roadmap beyond the next 90 days is not communicated publicly.
- How much of the product direction the founder still sets. Base44's blog still calls Maor Shlomo its Founder and CEO (1 September 2026), but decision rights inside Wix are not public.
These unknowns are themselves a signal. A platform that doesn't communicate its plans is harder to plan against.
Common acquisition-era mistakes
Assuming the platform you signed up for in early 2025 is the platform you have today. It is not. Re-evaluate annually.
Treating support response times as recoverable. They have not recovered post-acquisition. Plan around the slow path.
Skipping the security re-audit after the disclosures. If you set up your app pre-July 2025, you may still be running on patched-but-not-architecturally-fixed defaults. Re-audit.
Assuming the founder's documented responsiveness applies today. It does not. The founder is not the platform's customer-facing layer anymore.
Discounting the missing self-serve SLA because "it's been fine so far." February 3, 2026 was the proof point. Plan for the next one.
Summary
The Wix acquisition was financially good for Base44's founder and operationally mixed for Base44's users. The platform still works for what it works for — fast prototyping, AI-driven app construction, indie builds — but production apps face a higher operational burden than they did pre-acquisition. Plan accordingly.
The decision framework for whether to stay, harden, or migrate is in our is base44 production ready article. The realistic cost of leaving is in our vendor lock-in deep dive.
Want us to assess your acquisition-era exposure?
Our $497 audit reviews your app's security posture, support runbook, exit plan, and cost model in light of the post-acquisition reality. We deliver a prioritized list of mitigations. Order an audit or book a free 15-minute call.
Related reading
- Base44 after Wix acquisition — what changed in 2026 — companion deep-dive covering the $80M deal mechanics, contractual changes (Terms, DPA, the SLA position), how pricing and credit consumption changed, team retention, and the strategic question of whether Wix ownership is net positive for enterprise buyers.
- Base44 Pricing Real Costs Analysis — the detailed cost numbers behind the acquisition-era pricing.
- Base44 Limitations Explained — the structural limits that didn't get fixed post-acquisition.
- Is Base44 Production Ready? — the decision framework that incorporates post-acquisition risk.
- A trust verdict for the platform this year — our conclusion weighing the user sentiment and security disclosures tracked here.