Base44 + Supabase
Monitor a Supabase project connected to your Base44 app
Base44 uses its own managed backend by default: database, user management, backend functions and hosting. Its docs do not mention Supabase. If you connect your own Supabase project, the calls run in backend functions you write, and a function that holds a secret key without checking the caller bypasses RLS. Supahound scans that Supabase project daily and flags a secret key used from a browser.
Last updated
Base44 does not use Supabase by default. These pages apply when you connect your own Supabase project.
What are the Supabase security risks in Base44 apps?
Backend functions with a secret key and no caller check
Base44 has no Supabase integration, so any Supabase call runs in a Base44 backend function. A function that uses a secret or service_role key without its own authorization checks bypasses RLS for whoever reaches it.
A Supabase key pasted into frontend code
Base44 keeps secrets for backend functions. A Supabase key pasted into frontend code instead ships to the browser. Base44's security scan checks for exposed secrets, so run it before you publish, and keep sb_secret_ keys in Base44 secrets only.
Supabase tables outside Base44's data permissions
Base44's data permissions govern its own managed backend, not an external Supabase project. Tables created there with SQL start with RLS off until you enable it, whatever your Base44 permissions say.
How does Supahound protect your Base44 app?
- If you connect a Supabase project, the free posture scan reports its RLS coverage and Security Advisor findings, a check Base44's scan list does not include.
- The service-key detector alerts from day one when a Supabase secret key is used from a browser or a network the project has not seen.
- The scraping and bulk-export detector learns for 7 days, then flags an actor that suddenly reads far more rows than before.
- Supahound reads the Supabase project through read-only OAuth, so it needs no access to your Base44 account.
Frequently asked questions
- Does Base44 use Supabase?
- No. Base44 apps use Base44's managed backend and SDK, and its docs index does not mention Supabase. Supahound applies only if you connect your own Supabase project, usually from a backend function.
- Does Base44's security scan cover my Supabase project?
- Base44's scan checks its own permissions, user field access, private fields, exposed secrets, backend functions, dependencies and security headers. Its documented checks do not include RLS in an external Supabase project, so run Supabase's Security Advisor too.
- Was the 2025 Wiz finding on Base44 about Supabase?
- No. Wiz reported undocumented register and verify-otp endpoints that let anyone with a non-secret app_id create a verified account on private Base44 apps, bypassing SSO. Wix fixed it within 24 hours and reported no evidence of exploitation.
- What did Escape.tech's 2025 study find about Base44 apps?
- Escape.tech scanned over 5,600 public vibe-coded apps, about 159 of them on Base44, and reported its totals for the whole sample. The article does not break findings out per platform, so it says nothing specific about Base44 apps.
Watch your Base44 app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.
- Base44 docs: index (llms.txt)
- Base44 docs: Security overview
- Base44 docs: Running a security scan
- Wiz: Critical vulnerability in Base44 (July 2025)
- Escape.tech: How we found vulnerabilities in 5,600+ vibe-coded apps (October 2025)
- Supabase: Tables and RLS defaults
- Supabase: API keys
- Supabase: Database Advisors (lint 0013 and related lints)