A Base44 table lets anyone read or change rows

Symptom

Orders, messages, or other private records are visible to every visitor, including people who are not signed in.

Root cause

Base44's data permissions guide says it sets rules automatically as the app is built, and that the wrong people can view or change data when those rules are wrong. A person who matches any one rule gets that access. The All Users rule allows the action even without signing in, which the guide reserves for public data such as a catalog. Creator Only limits a record to the person who created it. Entity-User Field Comparison matches a field on the row to the signed-in account. User Property Check limits an action to an account property such as an admin role. A Permission risks detected banner appears on a table when the current rules may expose data, and Apply recommendations replaces them. Changes take effect immediately. The security scan guide says a data-permission finding is a table with no rules, or with more access than it should have. The publish panel shows security status and warns you, and it does not block publishing. Both guides say you are responsible for reviewing the settings. Permissions apply to a whole table, not to a single field.

In this Base44 app only, review data permissions. Do not change any other app.

1. For each table that holds private rows, such as orders, messages, or profiles, Read, Update, and Delete must not be All Users.
2. Use Creator Only when a person should see only rows they created. Use Entity-User Field Comparison when a field on the row names the account, and User Property Check when only an admin role should write.
3. Leave All Users only on data that is meant to be public, and only for the actions that should be public. A contact form can allow All Users to Create, and still restrict Read to an admin role.
4. If a Permission risks detected banner is showing, show me the risk before you apply the recommendation.
5. Stop so I can use Test Permissions in preview as two different people.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Base44 dashboard, open Data, then each private table, then Permissions. Write down any action set to All Users.
2. Run the security scan from Dashboard, then Security. Read the data-permission findings before you click Fix all.
3. Use Test Permissions in preview on your own app as two sample people. Each person should see only the rows they should. Changes made while testing are saved to that person's data, so use sample records.

Sources

• Base44: Managing data permissions
• Base44: Running a security scan