The Teardown · 5 Apps · Built on Base44
Five production apps, each built by a popular AI app-builder, each shipped and in daily use. Independently assessed, they collapse into the same shape — and not one is production-ready.
The dangerous part isn't that they're broken. It's that they look finished.
Every app fails across the four core pillars — Security, Code Quality, Architecture and Performance — at once.
The scores that look higher aren't proof of safety — they're the least-bad corner of a chart that's collapsed everywhere else. Same silhouette, different depth.
The entire admin boundary lived in the browser. A hard-coded email allowlist decided who was an admin — then made destructive API calls directly from the client. Skip the redirect, call the API, and you're in. The person who shipped it couldn't see the hole, because on screen everything worked.
// authorization decided entirely in client-side JavaScript if (ADMIN_EMAILS.includes(currentUser.email)) { // destructive calls fire straight from the browser base44.entities.ModelConfig.update(...) base44.entities.ModelConfig.delete(...) }
Why this matters
Every failure here is invisible from the outside and fixable from the inside. The apps compile, deploy, and demo perfectly — which is exactly why the risk hides. Finding it, proving it, and closing it isn't a vibe; it's engineering discipline. That's the whole gap.
Live assessment data · names anonymized · findings captured with file & line