# Base44 pre-launch checklist From BuildThenTested (https://buildthentested.com/built-with/base44/). 19 checks in the order we run them, most severe first. Each check links to a page with what it looks like, a self-check and a fix direction. Defaults referenced are from Wix's documentation, verified 2026-09-21. Tick a box only after you have seen the result yourself. ## Login and permissions - [ ] **Authorization enforced only in the browser** (critical). Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab. https://buildthentested.com/patterns/authorization-only-in-browser/ - [ ] **Tokens trusted without server verification** (critical). Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie. https://buildthentested.com/patterns/jwt-accepted-without-server-verification/ ## Payments - [ ] **Stripe webhook accepted without signature verification** (critical). In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook. https://buildthentested.com/patterns/stripe-webhook-without-signature-verification/ ## AI features - [ ] **LLM API key exposed to the client** (critical). Open your live app, press F12, select the Network tab, and use the AI feature once. https://buildthentested.com/patterns/llm-api-key-exposed-to-client/ - [ ] **No output validation before actions** (critical). List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code. https://buildthentested.com/patterns/no-output-validation-before-actions/ ## Payments - [ ] **No idempotency on payment handlers** (high). In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account. https://buildthentested.com/patterns/no-idempotency-on-payment-handlers/ - [ ] **Price or plan taken from the client** (high). Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab. https://buildthentested.com/patterns/price-or-plan-taken-from-client/ - [ ] **Subscription state trusted from local storage** (high). Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left. https://buildthentested.com/patterns/subscription-state-trusted-from-local-storage/ - [ ] **Stripe test keys in production** (high). Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_. https://buildthentested.com/patterns/test-keys-in-production/ ## AI features - [ ] **No spend cap on model calls** (high). Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set. https://buildthentested.com/patterns/no-spend-cap-on-model-calls/ - [ ] **Prompt injection through user content** (high). List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers. https://buildthentested.com/patterns/prompt-injection-through-user-content/ ## Reliability - [ ] **No rate limiting on sensitive routes** (high). Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab. https://buildthentested.com/patterns/no-rate-limiting/ ## AI features - [ ] **Unbounded input length to the model** (medium). Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit. https://buildthentested.com/patterns/unbounded-input-length-to-model/ ## Reliability - [ ] **Errors swallowed, spinner never stops** (medium). Open your app in Chrome and sign in as a normal user. https://buildthentested.com/patterns/errors-swallowed-ui-spins-forever/ - [ ] **Retries with no pause and no cap** (medium). Open your app in Chrome, press F12 and choose the Network tab. https://buildthentested.com/patterns/retries-without-backoff/ ## Performance - [ ] **One database query per list item** (medium). Open a page in your app that shows a list (orders, projects, customers) in Chrome, press F12, choose the Network tab and filter by "Fetch/XHR". https://buildthentested.com/patterns/n-plus-one-queries/ - [ ] **List endpoints that return everything** (medium). Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload. https://buildthentested.com/patterns/unpaginated-list-endpoints/ - [ ] **Whole table downloaded, filtered in the browser** (medium). Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload. https://buildthentested.com/patterns/whole-table-fetch-then-client-filter/ ## Deploy and config - [ ] **Missing security headers** (medium). Open your published app in Chrome or Firefox, press F12 and choose the Network tab. https://buildthentested.com/patterns/missing-security-headers/ --- We test against a defined checklist and report what we find. We do not guarantee that an app is free of vulnerabilities. We are not a certified penetration-testing firm and do not issue compliance attestations. We do not rebuild your app; fixes are yours or your developer's, and we re-check them. Questions: hello@buildthentested.com