Debugging& RLS

The interview log

Every question, on the record

42 statements logged. Search the file or pull a divider to narrow it.

Showing 42 of 42 statements

• Q-01Is RLS related to user roles? (Jordan)TechnicalExpand answer

  Yes — whatever user role you define, you condition the RLS rules on it.

• Q-02Any tips on PDF rendering? (Unknown)TechnicalExpand answer

  npm install react-pdf — then generate beautiful PDFs from HTML copies.

• Q-03How long does a Launchpad submission take to be approved? (Tiana)CommunityExpand answer

  Still in the initial-launch audit phase with thousands of submissions; the first batch is targeted for ~next week.

• Q-04Can you train a super agent to check WCAG compliance? (AJ)ProductExpand answer

  Yes — Sam believes that was demoed on a design app previously.

• Q-05With a Stripe paywall, is the user's payment info accessible through Base44? (Shelby)TechnicalExpand answer

  No — that's at Stripe level.

• Q-06How do I implement privacy/cookie pop-ups? (Ready Plus)TechnicalExpand answer

  Integrate a cookie service (e.g. Cookiebot) — get the API key, give it to Base, prompt to implement it as a cookie tracker.

• Q-07Can you train a super agent to do entity-level security checks regularly? (Mark)ProductKeyExpand answer

  Yes — that's an end-to-end agent. And the Testing Agent (embedded, automated checkups) is rolling out this week.

• Q-08After RLS, how do I get the app SOC 2 certified? (Muhammad)BusinessExpand answer

  Not Sam's area. Base itself is SOC 2 certified; your app's certification depends on the requirements, which Sam won't guess at.

• Q-09New EU law requires data stored in Europe — how will you help European users? (Newbie)BusinessExpand answer

  That's long-standing (GDPR). On an elite plan you can migrate your data-center location to Europe.

• Q-10Base says it executed a prompt but it's not working — my credits are still used. (Ready Plus)BusinessExpand answer

  LLMs sometimes have issues — revert and resend. Base44 isn't an AI; it leverages Claude/GPT/Opus/Gemini, and a failed prompt (e.g. a model going offline) still costs Base tokens.

• Q-11To clarify — always run the overview security scan on the dashboard, then…? (Shelby)TechnicalExpand answer

  Prefer per-entity scans over the global one; review manually. For serious security, you need expert measures beyond yourself and the AI.

• Q-12How do I dump all my data to migrate to another server? (Ray Coder)TechnicalExpand answer

  Sync to Git (button next to Publish).

• Q-13If you're not tech-savvy, how do you know if it's hackable just from the security scans? (Tayiana)CommunityKeyExpand answer

  You won't. That's the hard part of this space — building is easy, but securing/distributing/marketing needs experience. Ask experts, attend sessions, read guides; pay specialists when it gets serious.

• Q-14Can you transfer the app to GitHub if you don't want to keep the Base44 subscription? (Unknown)TechnicalExpand answer

  Yes — it's a two-way Git sync. It doesn't take the Base SDK with it, so you'd need to rebuild.

• Q-15I made a crypto casino — can Base handle such an app? (Mullen)BusinessExpand answer

  You'd need a gambling licence, and it's against the rules as far as Sam is aware.

• Q-16Any guidance on taking your build to a dev/prod GitHub to store code? (Unknown)TechnicalExpand answer

  No guide — hook up Git and do it. Branches (git-like, inside Base) are coming.

• Q-17Can I publish to the Android Play Store without Pro? (Mullen)BusinessExpand answer

  Roughly builder-plus.

• Q-18If a page is hacked, can you restore data from a certain date? (Programmer)TechnicalExpand answer

  There are backups within reason — open a support ticket; nothing the community can do.

• Q-19Wasn't there talk of credits rolling over? (Roy)BusinessExpand answer

  It existed for ~2 hours before being reverted ~2 months ago, with no update since.

• Q-20My bespoke ACP feels like Base RLS overrides it. (Habit)TechnicalExpand answer

  The ACP should run the backend SDK functions and dictate the same security — it shouldn't be overridden.

• Q-21Why isn't AI auto-fixing security issues? (Newbie)TechnicalKeyExpand answer

  Security improves continuously, but every prompt invalidates prior security. Fix the whole app, type "hi," and your security is effectively gone — you must re-evaluate after each prompt.

• Q-22I added a paywall and now can't access my own app in the builder. (Vicky)TechnicalKeyExpand answer

  Prompt "Please ensure all admins bypass our paywall." You're an admin by default in the preview window, so you'll never be locked out again.

• Q-23How do I set up an admin control panel for RLS? (Habit)TechnicalExpand answer

  Prompt "Please implement an admin control panel to secure RLS."

• Q-24When will we get a QA environment / UAT before prod? (Unknown)ProductKeyExpand answer

  Coming — internally called "branches" (git-like, with dev channels and people working on the same project on branch level). Not ready yet.

• Q-25Is custom login released yet? (BC)ProductExpand answer

  At 50% of users, new apps only (possibly scaling to 100%). Existing-app backporting is in progress.

• Q-26What's the best way to stay up to date with feature releases? (BC)CommunityExpand answer

  This Discord plus Base44 socials (LinkedIn, X). Surfacing releases better (tiered visibility for users/ambassadors/partners/mods) is a long-term goal of Sam's.

• Q-27When will the account-takeover vulnerability be addressed? (Pantheon)CommunityExpand answer

  Sam can't disclose bug-bounty / security-report details as community engagement manager.

• Q-28When users sign up for my app, do they become Base44 users too? (Tan)BusinessExpand answer

  No — and no, they can't see your dashboard/data.

• Q-29Building a competition app — is there a limit on how many people can be on the site? (Ryuji)TechnicalKeyExpand answer

  No hard limit. Whether it breaks depends on structure/scale. A million people on a landing page is fine; one user pulling 10,000 rows breaks immediately. At scale, integrate third-party APIs (e.g. Firebase) for heavy data.

• Q-30Why is the users entity the only one with strict RLS by default? (OG)TechnicalExpand answer

  Base controls the users table (it's mandatory and must be secure). Entities you create are your creations to secure — if Base locked them by default you couldn't build apps.

• Q-31When will super agents be available? (Unknown)ProductExpand answer

  They've been available ~3 months. Super agents building inside the builder is still in testing.

• Q-32Can I publish to the Apple store, and is there a specific plan? (Alex)BusinessExpand answer

  Yes — Publish → mobile tab. Roughly the builder-plus plan.

• Q-33Should I put the debugging/RLS controls inside a backend admin panel, or just use Base itself? (Megan)ProductExpand answer

  Your comfort. Base's RLS structure is enough on its own, but an admin control panel is nicer — Sam uses ACPs on production apps.

• Q-34Google login modal closes and the user is no longer authenticated on mobile. (Ray Coder)TechnicalExpand answer

  A redirect issue Sam has seen before — open a support ticket.

• Q-35My app captures leads but never emails them to my Gmail. (Sheic)TechnicalKeyExpand answer

  The recipient email must be signed up in the app's users table. Sign up with the address you want to receive mail at and it'll work.

• Q-36Can you set up two versions of the same app for admins/supervisors and users? (Ready Plus)ProductKeyExpand answer

  You never need two apps — create different views via RLS (one homepage with restricted data for a role, another for users).

• Q-37My app's emails have awkward AI formatting. (Twister)TechnicalKeyExpand answer

  Prompt "Please format all Invoke Send Mail emails in HTML, using our app's theming and branding in template format."

• Q-38Why is changing RLS on this platform so slow? (Yaku)TechnicalExpand answer

  Because the scan evaluates the context of your whole app, not just whether the table is secure. A huge app takes longer; a two-tab landing page is instant.

• Q-39Is there a way to monitor how much credit a super agent is using? (M / MP)BusinessExpand answer

  Yes — check the agent's Tasks. For line-by-line integration-credit spend, open a support ticket.

• Q-40Do you find the security check via the builder chat or via the RLS settings works best? (Ro)TechnicalKeyExpand answer

  Entity-level scanning is the only one Sam fully trusts. The global "fix all" is temperamental at scale. Use a combination of per-entity scans plus manual review.

• Q-41If something breaks while I have active paying users, how do I fix it without risking user info? (Shelby)TechnicalKeyExpand answer

  No risk if you secured the app and didn't prompt again — it won't spontaneously break. But every new prompt can create holes, so you must re-evaluate security after each prompt once you're in production.

• Q-42What kind of information is in the database? (Mullen, YouTube)GeneralExpand answer

  Whatever you store — databases don't pre-populate. Secure each entity ad hoc; some need to be open to all users, some admin-only, some creator-only.