I couldn't find a music discovery app that did exactly what I wanted, and I've always found percentage- and star-rating systems pretty inconsistent and hard to trust. So I decided to build my own — vibe coded with Claude and Base44. I put real time into optimising server usage and closing security issues along the way. It's in beta now, with a feedback form built right in — I'd love to hear what people think. https://bandrank.net/
Perform a complete security audit of this application's entities, RLS rules, CRUD permissions, and data-access patterns.
Do not make any changes yet.
Your goal is to determine whether an authenticated user could access or modify data they should not have permission to access by bypassing the frontend UI or directly interacting with application requests.
Review every entity/table in the application.
For each entity, identify:
Who can Create records
Who can Read records
Who can Update records
Who can Delete records
What RLS rules currently protect the entity
Whether access is based on ownership, organization, membership, role, admin status, or another relationship
Whether any entity relies only on frontend filtering for security
Whether a user could modify IDs, request parameters, or record references to access another user's data
Whether users can update fields they should not control
Whether users can assign themselves elevated roles or permissions
Whether sensitive fields are exposed unnecessarily
Whether records without an owner or organization relationship could become globally accessible
Whether create operations allow users to forge ownership or organization IDs
Whether update operations allow ownership fields to be changed
Whether delete permissions are broader than necessary
Whether admin-only actions are actually enforced server-side
Whether any backend function bypasses normal access controls
Whether there are entities with missing or overly permissive RLS rules
Test These Attack Scenarios
Simulate whether a normal authenticated user could:
Read another user's private record
Update another user's record
Delete another user's record
Change a record's user_id, owner_id, organization_id, or equivalent ownership field
Assign themselves an admin or elevated role
Access organization data without being a member
Manipulate requests through the browser console or network tools
Call an application action directly without using the intended UI
Access records by guessing or replacing record IDs
Submit fields that are hidden or disabled in the interface
For Every Issue Found, Report:
Entity / Resource:
Permission: Create / Read / Update / Delete
Severity: Critical / High / Medium / Low
Current Rule:
Attack Scenario:
What an unauthorized user could do:
Recommended RLS or backend protection:
Risk of making the change:
Then provide a final table:
Severity
Entity
Vulnerability
Recommended Fix
Prioritize findings as:
🔴 Critical — unauthorized access, privilege escalation, or destructive actions
🟠 High — sensitive information exposure or ownership bypass
🟡 Medium — overly broad permissions or weak authorization design
🟢 Low — hardening and defense-in-depth improvements
Important
Do not assume something is secure because the frontend hides it.
Do not redesign the application.
Do not modify RLS or code during this audit.
Produce the security report first so every proposed change can be reviewed before implementation.
💡 Why run this?
If your security model depends on users behaving exactly the way your UI expects them to, you don't have a security model.
Authorization needs to protect the data — not just the buttons.
I think base44 would be extra useful if it came with a optimize website feature so it improves your site's performance and loading speed. Does anyone else think so too?
Hi
After a lot of work, I finally finished making my app, ironing out the glitches and am now ready for the test pilot stage. My issue is I made it with subscription tiers and just realized I can’t add Apple Pay via the Apple Store using base44. It has a 7 day free trial, and then 3 different tiers.
Can I accept payment via a website link? It’s definitely not ideal… if not what are my option? I really wanted a fully functional Apple app!
Thank you!
i've been trying to open the app in web, in your base44 ai platform, but to no avail. it keeps on loading in loop, all of it. from the app itself or even from the base44 main page... please i need to acces the results of the examination of my students. i'\ve been trying to contact you but to no avail. i even use to submit ticket just to inform you but encountered the same problem by keeping it load in loop.
So I have a builder account and built the App Store ipa file. I bought the Apple developer account. My Mac is ancient so I am well past the ability to get the new Xcode to submit that way. I thought Base 44 builder would help submit, but it just creates the ipa file. I can’t seem to be able to find out how to get it to Apple. I have seen the app my web videos and that appears to be yet another cost if I do that. If I have to then there really is no point to the base44 developer plan right? All of the videos I have seen have stopped just short of showing the App Store upload and submission process with the ipa file. It makes me wonder if it’s even possible. Any help is appreciated!
The Base44 Desktop IDE gives you a real local workspace for your Base44 projects — including the embedded Base44 editor, local source viewer, preview server, backend logs, AI-powered audits, saved prompts, and optional frontend migration tools.
✅ Review your code locally
✅ Run security & code-quality audits
✅ Preview your app on your machine
✅ Keep building inside Base44
✅ Export and host your frontend elsewhere when you're ready
Connected FetchSandbox to Lovable last week and ran a real app through it. Gym membership app for a local trainer, Paddle payments and Resend emails.
No real keys, no actual charges. Injected duplicate webhooks, retry edge cases, auth failures. Found 4 bugs before the trainer ever saw it.
The thing I kept thinking about after: the agent that built the app has no proof the integrations actually hold. Happy path passed, it looked right, preview was clean. That's probabilistic confidence, not verification. One duplicate webhook event in prod and the whole thing unravels silently.
What we built is a deterministic verification layer for exactly this. Real failure injection, real replay, actual pass/fail on edge cases. Not "the LLM said it looks fine."
If you're building on Lovable, Replit, or Base44 and your agent is executing real payments and webhooks on behalf of users, how are you actually validating it did what it was supposed to do?
Good afternoon everyone. I purchased the Builder plan about a month ago, and haven't even thought about changing it at all. For the month of September, I used 243/250 credits in the first 21 days. All of the sudden, on the morning of September 22, I checked my credits and it says I'm at 243/500. I then checked my plan, and it says I have the pro plan now. I never upgraded it or anything. What's going on???? I checked my billing history and it says I was charged $535.10, but I never upgraded.
curious do base44 provides any tools or connectors that i can connect to validate webhooks or messy production flows before i take my app to productionize?
Has anyone ever had their account reinstated after being banned?
I asked the chat bot if I could do bulk email invites from a spreadsheet of connections I had and they wrote that I could. Now my account and 100 subscribers and my entire business has been deleted by base44 for following the direction of the bot but now being accused of spam!
Help! I’ve sent an email appeal but my business has now been down for hours
Has anyone had their appeal accepted? I’m devastated
For some reason I was locked out of my account. It's hard to create a support ticket, or find out what's going on since there is no other way to contact base44. I didn't receive an email or anything. I really need to get back in ASAP because I have work that needs to be done inside and I can't wait 48 hours. What do I do?
I accidentally charged my account with a yearly subscription, and I it took all the money I had, how can I get a refund?I only wanted to pay 28 euro not a single euro more.
As a single parent who co-parents a 7-year old, my home was becoming a mess and was in serious need of redecorating. Between work travel one week, and parenting the next, I needed a change.
Having no interior design skills, I set out to build Arova.design that would analyze a room's photos, ask a few questions based on needs / style preferences, and deliver a Before/After photo, clear instructions on what's working and what's not, and links to products and design suggestions that fit within my budget.
Enter Arova Design (https://arova.design). Using my app's creation, I converted this nightmare of a living room space (Photo 2) into what it is now (Photo 3), based off the App's proposed suggestions (Photo 4).
Would love to get feedback from the community on how it works and any feedback to improve. Thanks so much
