The rules that matter most
In Base44 each kind of data, like orders or messages, has its own rules: who can create a record, who can read it, who can change it and who can delete it. A rule can also hide one field, like an email address, from everyone but the owner or an admin.
The common mistake is a rule that’s wider than it should be: every signed-in user can read every order, not just their own. Nothing looks broken, which is why it goes unnoticed.
Three places to look
Your data rules
For each kind of data, ask who should read it. If the answer is “only the person who made it”, the rule should say so.
Backend functions
Code that runs as the app itself skips the data rules. Each such function has to check who’s asking before it reads or changes anything.
Keys in the code
A secret key written into the app, for payments or an AI service, can be read by anyone who finds it. Keep secrets out of the code itself.
Check it yourself
- Run Base44’s security scan. It looks at your data rules, keys written into the code, open backend functions, outdated packages and missing website protections, and suggests tighter rules where data is too open.
- Run our free outside scan on your live address for a second opinion on what strangers can see.
- Make two test accounts. Signed in as one, try to reach the other’s records. You should see nothing.
- Scan again after every change you publish: a result goes stale as soon as the app changes.
Sources (Base44’s docs)
When to bring in an engineer
When the scan keeps flagging the same rule, when tightening a rule breaks something your users need, or before you take payments or store anything personal. Someone who reads how your app actually works can set rules that are tight without getting in the way.