Security Dashboard
Phase 11 security hardening status and platform limitations
31
7
3
4
Base44 does not provide app-level MFA configuration. MFA, if available, is managed at the platform/account level.
Mitigation: Recommend enabling platform-level MFA for all staff accounts. Document as limitation for Phase 12.
Session lifecycle (expiration, revocation after password reset, concurrent session limits) is managed by the Base44 platform, not the app.
Mitigation: Rely on platform session controls. Logout is available in-app. Document as platform-managed.
Base44 UploadFile returns public URLs. UploadPrivateFile returns private URIs requiring signed URLs. Current implementation uses UploadFile for most documents.
Mitigation: Recommend migrating sensitive documents (orders, financial docs) to UploadPrivateFile in Phase 12. Signed URLs provide time-limited authenticated access.
Intake API authentication uses a shared API key (INTAKE_API_KEY). Replay protection and rate limiting are not app-level controls.
Mitigation: API key stored in Base44 secrets (not in code). Recommend adding request signing or IP allowlisting in Phase 12 if platform supports it.
Backup and recovery is managed by the Base44 platform. App-level backup configuration is not available.
Mitigation: Confirm backup schedule and recovery procedures with Base44 support before production launch.
Base44 does not provide separate dev/staging/prod environments within a single app.
Mitigation: Use is_test_record flag to isolate test data. Recommend separate Base44 apps for staging if needed.
Base44 does not provide database-level atomic transactions or row-level locking.
Mitigation: Backend functions implement application-level checks before resource reservation and payment authorization. Race conditions are mitigated but not eliminated at the database level.
Authorization Enforcement Statement
Applicant, Sponsor, Staff, Finance, Admin, and Super Admin access is enforced through server-side Row-Level Security (RLS) on every entity, not through UI hiding alone. A user who lacks permission is denied at the data layer even if they attempt direct URL access, API calls, or browser developer tools.
Audit Integrity Statement
Standard staff, applicants, sponsors, and AI cannot erase or rewrite financial and audit history. AuditLog, ConfigChangeHistory, and DisclosureLog are append-only or delete-protected at the RLS level.
AI Boundary Statement
AI remains advisory and cannot use uploaded document instructions to bypass TFT rules, approve cases, assign resources, disclose protected data, authorize payments, or change system configuration.