Base44 Security Scan Now Flags Editable User Fields
Base44Base44's security scan now flags custom User fields that data permission rules depend on but that app users can edit themselves. An example is a company field that decides which records someone can see. Clicking Fix All on the scan card locks these fields so only the app's editors can change them.
Key Takeaways
- The security scan now detects User fields that permission rules depend on but that users can edit on their own.
- A typical risk is a company field that controls which records are visible, which a user could otherwise change to see other people's data.
- Fix All locks the flagged fields so only the app's editors can change them.
- The check turns a subtle access-control flaw into a clearly labeled finding on the scan card.
- It extends the existing security scan rather than adding a separate tool, so builders get it by rerunning a scan.
- No plan requirement is listed, and the scan itself is available on all plans according to Base44's docs.
Closing a Permission Loophole in User Fields
Base44 extended its security scan to catch a subtle but serious access problem. Many apps store custom data on the User record, such as a company or team field, and then write data permission rules that use that field to decide which records a person can see. If app users are able to edit that field on their own profile, they can change their own value and gain access to someone else's data.
What the scan now checks
The scan now looks for custom User fields that permission rules rely on but that users can modify themselves. When it finds one, it reports it as a finding. A typical example is a company field that determines which records a person is allowed to view.
One-click fix
The scan card offers a Fix All button. Clicking it locks the affected fields, so only the app's editors can change them. App users can no longer rewrite the values that their own access depends on.
Why it matters
This turns a hard-to-spot logic flaw into a visible, fixable item in a scan builders already run. No plan requirement is listed, and the check appears as part of the existing scan. Base44 documents it in the security scan guide under the "user field access" section.