Skip to content
BuildThenTestedSee packages

Base44 pre-launch checklist

19 checks in the order we run them, most severe first. Each one has a self-check you can do in the Base44 dashboard and your browser, and a fix direction. Free to use; nothing to sign up for.
Download .md

Defaults referenced come from Wix's documentation, verified 2026-09-21, on the Base44 hub.

  1. Login and permissions

  2. Payments

    • Stripe webhook accepted without signature verification

      In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.

      Critical
    • No idempotency on payment handlers

      In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.

      High
    • Price or plan taken from the client

      Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.

      High
    • Subscription state trusted from local storage

      Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.

      High
    • Stripe test keys in production

      Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.

      High

  3. AI features

    • LLM API key exposed to the client

      Open your live app, press F12, select the Network tab, and use the AI feature once.

      Critical
    • No output validation before actions

      List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.

      Critical
    • No spend cap on model calls

      Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set.

      High
    • Prompt injection through user content

      List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers.

      High
    • Unbounded input length to the model

      Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit.

      Medium

  4. Reliability

  5. Performance

  6. Deploy and config

Questions

base44 security checklist

The list above: 19 checks across 6 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.

can i use this checklist without buying anything

Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.

Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.