Office Hours #78 · 14 October 2026
Unlimited
storage.
Limited rates.
An open drop-in on limits, secrets, private files, and the spikes everyone felt.
Security Week drop-in
Limits, secrets,
and straight talk.
The Security Week drop-in mixes platform questions with security ones. Storage and user counts are unlimited, but rate limits scale with your plan. Backend secrets never reach users; search your code for any hard-coded key. Upload private files to private storage behind signed URLs. Treat your app's security as your responsibility.
Sam and Robert are open about a roughly 27-hour run of intermittent latency spikes. Teams were working on it, and asking the builder to reduce repeated requests and add caching helps in the meantime. They also explain that payouts, holds, and verification happen at Stripe, not Base44; that a browser app cannot permanently mount a local Windows folder, so sync to cloud storage instead; how support tickets work and why duplicates slow things down; and what Microsoft sign-in requires.
Sam reflects on game development: he predicted in March that big engines would build LLM prompting in, and Unity has now partnered with Google to do it. A Base44 Twitch channel arrives at the end of the month.
Who owns what
Base44, Stripe,
and you.
- 01
Base44
Hosting, storage, secrets, and platform security.
- 02
Your processor
Payouts, holds, verification, and refunds.
- 03
You
RLS, roles, private files, and your app's policies.
- 04
Support
One ticket per issue. Moderators can escalate.
7 lessons
Small checks,
real safety.
- 01
Storage is unlimited, rate limits are not
There is no storage or user cap on any plan, but request rate limits rise with higher plans. Give the rate-limit documentation to the builder so it designs within those limits.
- 02
Secrets stay secret
API keys stored as backend secrets are never exposed. To be sure, open the code view's file search and search for the key itself. If it appears in a file, move it into a secret.
- 03
Use private uploads for sensitive files
Ordinary uploads are public to anyone with the URL. Use private file upload so files sit in private storage behind signed URLs. Support can delete and invalidate files that were exposed by mistake.
- 04
Compress media for speed
Phone photos can be 20 MB or more, and hero videos rarely need 4K. Ask the builder to compress uploads and serve smaller sizes, and use Discuss mode to choose an approach.
- 05
Payments live at your processor
Payouts, holds, and verification are handled by Stripe or whichever gateway you use. Separate Stripe accounts per business keep things clear.
- 06
Browsers can't mount local folders
For hundreds of local audio files, sync the folder to cloud storage and pull from there instead of reconnecting a local folder every session.
- 07
Help support help you
Don't open duplicate tickets, because they join the queue and split the conversation. Response targets are about 24–48 hours, and moderators can escalate an overdue ticket ID.
Twitch,
and a fix.
As stated on 14 October 2026.
- Update 01
Base44 on Twitch
A Base44 Twitch channel launches at the end of October, so Office Hours will multistream to Discord, YouTube, and Twitch.
- Update 02
Intermittent latency under investigation
There had been about 27 hours of brief, intermittent spikes affecting some users. A cleared notice will be posted in Discord announcements.
- Update 03
Top-ups are not coming for now
The top-up A/B test ended and will not go ahead. The team is listening to feedback.
- Update 04
Thursday: go-live security
Pentesting through MCP, debugging, and a security guide app.
Drop-in questions,
answered.
Every substantive question from the hour, including answers the hosts could not confirm.
17 of 17 answers
Unlimited on every plan.
It depends on optimisation: how you pull data and images, caching, and backend functions. Higher plans also have higher rate limits.
No. To double-check, search your code for the key. If it appears in a file, move it into a secret.
Use private file uploads with signed URLs, and set RLS on the tables that reference them.
There have been intermittent spikes for some users, lasting a few minutes at a time, and teams are working on it. Ask the builder to reduce repeated requests and add caching.
Someone is always on shift. Make sure you are on the official app.base44.com support page and not a fake app, and send a screenshot of the offline message to staff.
Yes. Organisations usually have to add the app in Microsoft 365, otherwise you see an unverified error. You can also configure SSO under Authentication.
It is not on the roadmap that the hosts know of, but you can probably integrate it. Post it on the feedback board.
Sam believes they will get their own virtual computer instance rather than taking over yours. This was not confirmed.
They are on the radar internally. More requests help.
Check Stripe. Base44 doesn't hold your money, and each app's gateway is whatever you connected.
Neither host had heard of it. They asked for details to escalate.
Yes.
There would be notice. Sync to GitHub, which happens automatically on publish once connected, or export your code.
Yes. Prompt it to install i18n and translate the interface.
Sam doesn't know the product plans, but notes that Unity has now built LLM prompting in with Google, which he predicted in March. Game building on Base44 is already very capable.
It may predate the infrastructure migration. Send Robert the link.
Watch the original
Sam and Robert,
live.
Open on YouTube Latency and limit details reflect what the hosts knew on 14 October 2026. Forward-looking product comments, such as Super Agent computers and WhatsApp calling, are not commitments.
Bring this to your next build
Check it
before launch.
- 01
Design for your plan's rate limits, not for storage limits.
- 02
Search your code for any raw API key.
- 03
Upload sensitive files privately, behind signed URLs.
- 04
Compress images and video before they slow everyone down.
- 05
One ticket per issue, then ask a moderator to escalate.
Keep learning
Further reading.
- Base44 rate limits (developer docs)
- Writing better prompts
- Stripe payouts documentation
- Base44 feedback board
- Previous security session VOD
Unofficial community archive · All Office Hours