Honesty note
About Leak Hunt
A free, simulated game. Nothing here can touch a real app.
Why it exists
Base44 makes it quick to ship an app, and it handles a lot of security for you out of the box: data encryption, SOC 2 Type II and ISO 27001 certification, and platform-level protections. You do not need to be a security expert to build a safe app on Base44.
But you are responsible for your own app's security settings: who can read and write each table, which backend functions check their caller, where your keys live, and how your app can be embedded. Those are easy to leave until last, and easy to skim in a docs page. Leak Hunt turns them into something you can see happen, then close.
This guide does not replace Base44's security scan. The scan is the authority. Run it before you publish and again after significant changes.
What is fake, and what is real
Simulated
- PetPals Bookings, the app you attack
- Every leaked booking, name and address
- The API key in level 3
- The “blocked” results after you lock each leak
- The staff dashboard and the export function in the level-up pack
Real
- The Base44 menu names and where to click
- The permission and secrets settings each fix uses
- The scan wording quoted in the checklist
- Your Leak Score, saved in your own browser
No real data is ever touched, and nothing here can probe a live app. Only audit apps you own.
What the hunt covers
How it was made
- Built on Base44A React app with no database and no backend functions. The security scan finds nothing to flag, which is the point.
- No sign-up, no databaseYour progress, checklist ticks and audit steps live in your own browser storage. Clear it and they are gone.
- Illustrations are AI-generatedThe level art, hero loop and share image were generated with Higgsfield, then edited and optimised for this app.
Sources
- Base44 security: An overview
- Running a security scan
- Managing data permissions
- Choosing who can access your app
- Backend functions overview
Checked against these pages on 16 Oct 2026. Docs change, so check the latest. Level 6 (guessable ids) is a general security lesson, not taken from Base44's docs.
The person behind it
About Dean Lynn
I'm a founder and operator, and I've been building and running businesses since 2005. These days I put AI into businesses that already run.
I'm a Base44 Ambassador based in Stamford, Lincolnshire, where I run free, in-person AI sessions for local builders. Leak Hunt is my attempt to make the pre-publish security check something a builder actually wants to do.
Pass it on
Know a Base44 builder about to publish? Send them the hunt.
Start the hunt