Skip to content

The Hunt: nine simulated Base44 security leaks and a bonus

LEVEL 8 / 100/9

Core hunt 1–6 · Level-up pack 7–9 · ★ Bonus

Level 8Level-up pack

The rule that matches nobody

The scenario

PetPals' owner writes a Read rule so customers only see their own bookings: created_by must equal the user's id.

But created_by holds an email address, not an id. The rule matches nobody, every customer sees an empty list, and the owner panics and sets Read to All Users to make it work.

Guided hint · Beginner mode

Open the table's Permissions and read the rule out loud: “created_by equals …”. Is the value on the right the same kind of thing as created_by? An email never equals an id.

Skip to the checklist

Leak Hunt is a free, simulated security guide for Base44 builders. Everything here is fake.

Made by Dean Lynn · Sources and honesty note