Advisories Tools Stats Checklist Submit Get the email

App builders · Wix

Base44

All-in-one AI app platform (owned by Wix) with built-in auth and data.

6Advisories

3critical

3high

0medium

2026-08Latest

Timeline · advisories per quarter

22025 Q1

12025 Q3

32026 Q3

Named in sources

Reported for Base44

01. criticalBroken access controlSupabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.

v0 +4 more 2026-08 02. criticalSecret exposureSupabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.

v0 +4 more 2026-08 03. criticalBroken access controlBase44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours.

Base44 2025-07 04. highSecret exposureSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.

v0 +4 more 2026-08 05. highBroken access controlAuthentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly.

Bolt +3 more 2025

Same pattern

Also worth checking

01. highSupply chainSlopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names.

Cursor +5 more 2025