Base44 test data

The Fitting Room brief was pasted word for word (1,689 characters) at 08:15:38 UTC. The clock stopped when the app was live and 25 of the 30 checks passed. Every prompt and its credits are in the ledger.

Base44 asked one thing: to approve a Stripe install, at 08:17:01, which I did from the brief. The build went idle at 08:23:44 with "Stopped before finishing: the live preview isn't picking up the new screens, write continue". A free page reload at 08:24:34 showed the finished app, so no prompt was spent. I published at about 08:25:5x, about 10 minutes 20 seconds after submitting.

25 of the 30 checks were true on that first live version; the first draft used 6.73 credits. The coach role was not applied (four checks) and one line of copy was wrong.

Prompt 2 told Base44 about the coach role and the Team tab (3.81 credits, 310 seconds). It published at 09:07; I set the two coach accounts' roles by hand in the app's own Team tab at 09:13, and 30 of 30 passed at 09:21:37: 1 hour 6 minutes and 2 prompts in all.

• The preview stalled once and needed a reload; that is counted in the 10 minutes 20 seconds.

The 30 checks were run against the live app, by hand and by script, with a screenshot per check. The inbox and Stripe checks (C03, C26 to C29) were read by hand. I also counted anything the brief never asked for.

The final app passed 30 of 30, and again after all twelve changes. The first draft passed 25 of 30: C04, C13, C14 and C15 (the coach role) and C30 (a line saying "six sessions a week" when the timetable has five).

Unrequested copy is still live: the pricing line "One credit per class, no expiry" (a pass rule the brief never set), three class taglines ("Foundations on the reformer", "Mat work, breath and flow", "A strong, faster reformer session") and "or drop by the studio and say hello" on the About page. No extra classes, prices, coaches or reviews were added.

Base44 also kept leftover bookings of deleted classes in the data.

• Five of my first measurement's failures were my own script's selector bugs; they passed once fixed, with the app unchanged.

Sign-up, log-in, log-out and password reset for a member, a coach and an admin, then two attacks on the live app with the wrong session: member A reading member B's bookings, and a member calling admin-only actions. Requests and responses are saved as transcripts.

Every flow worked. New accounts need an emailed code (member A got in once before verifying; the other four were refused until the code was typed). The password reset link was requested at 08:49:10, was in the inbox the same minute, and the new password worked. Admins and coaches come in by emailed invite or the Team tab.

Attack 1 was blocked. Member A's own list held only A's rows; filtering by B's email returned nothing, B's booking id returned 404, editing it returned 403, and the cancel function with B's booking id returned 400. Orders and messages also showed only A's own rows, and anonymous calls returned empty arrays.

Attack 2 was blocked. Changing a class returned 403 and deleting one returned 404 (an admin confirmed it still existed). The team-role function answered 403 with "Only a studio admin can manage the studio team", and anonymous calls to the six protected functions returned 401 or 403. The capacity rule is enforced on the server (409 "This class is full").

Base44's own security panel listed 8 issues, none about access: zod (1 known vulnerability, High), vite (6, High) and backend functions that "can be called by anyone" (Low, 5 at first, 8 after the changes). Probing those functions anonymously showed each one checks the caller itself.

• "Code vulnerability scanning" needs the Builder plan and was not run.

Six checks: the form and bookings write real records; they survive a reload, a republish and a design change; the admin can view, filter, edit and delete in Base44's own data panel; records export as a file. Row counts were taken before and after.

Six of six passed. The form and bookings wrote to the ContactMessage, Booking and Order tables. The app was published 7 times with nothing lost, and the colour change and dark mode kept every record.

In the data panel the admin can view rows, search, filter by created and updated dates (there is no per-field filter), edit a cell (saved and survived a reload) and delete (the row moves to Trash, and "Recently deleted" exists). Export is a CSV per table.

"Backup & Restore" is a Premium feature and a test data environment needs Builder. Record limits are not stated.

• Backup and restore and the test data environment were not run (plan limits).

A Stripe test checkout from inside the app with the 4242 test card, a declined card (4000 0000 0000 0002), and the booking, studio-cancel and reset emails read from a seeded inbox.

Base44 installed its own unclaimed Stripe sandbox ("Sandbox: no real payments"), so I needed no keys. Checkout opened at $95.00. With the test card the payment succeeded, the success page showed the receipt, the order appeared in the admin's Payments tab and the member went from 0 to 5 credits. A second pass bought later by member A worked the same way.

The app's confirmCheckout function runs on the success page and writes the order. I saw no separate webhook, and I did not test a buyer who closes the tab before the redirect.

The declined card showed "Your credit card was declined" on the Stripe page, with no order and no credits.

The booking confirmation ("Booked: Reformer Basics, Monday 7:00 am") and the admin's "New booking" email arrived in the same minute as the click, at 08:45 UTC, in the inbox and not in spam. The studio-cancel email and the reset link also arrived within the minute. The sender is no-reply@notifications.base44.com, shown as "Fitting Room App".

• Branded and custom emails need Builder. Base44 notes that emailing people who have not signed up "works once you connect a custom domain".

The twelve scripted changes, one at a time. After each change I published and re-ran the 30 checks. Credits, seconds and results are in the ledger.

11 of the 12 changes worked first try. Number 8 needed a second prompt. No change broke any of the 30 checks.

Base44 never asked before a destructive action (it did not need to), and it did not fall into a loop of failed fixes. Change 11 showed one self-corrected test script.

The twelve changes used 35.27 credits including the bug plant (2.82) and the follow-up on change 8 (2.82).

• Four mistakes in my own check scripts cost no credits.

Publish to the Base44 address, connect my test domain with HTTPS (timed), seed 100 classes and 200 bookings through the app's own API, run Lighthouse mobile three times on the log-in page and the timetable, and count layout faults at 360, 768 and 1440 pixels.

The Base44 address was live 12 seconds after I clicked Publish (each republish took 4 to 14 seconds). Base44 refused my first domain name with "You cannot use a domain that contains a social media platform" (the cause is unclear) and accepted fittingroom.test.rankdude.ai. I added the domain at 10:53, a failed DNS command of mine delayed the record to 11:02:12, and HTTPS answered 200 at 11:05:18, 3 minutes 6 seconds after the record. About 12 minutes in all, including that slip.

By default there is no robots tag. The prompt "add noindex" returned "this is a platform setting", changed no code and still cost 1.81 credits. I set it by hand in Dashboard > SEO & GEO (search visibility Off on 14 pages), and curl shows noindex, nofollow on every real page. robots.txt still says Allow: / and sitemap.xml is empty.

The timetable with 100 classes loaded in about 2.9 seconds. Lighthouse mobile (version 13.5.0, run locally because the PageSpeed API quota was spent): log-in page 74, 81, 81; timetable 63, 74, 67; median of the six 74. Largest paint 3.7 to 4.6 seconds, layout shift 0 to 0.215, blocking time 0 ms, 289 and 360 KB.

No page scrolled sideways. I counted 3 faults: the admin classes table is wider than a phone at 360 pixels (it scrolls inside its box), the "Forgot password?" link is 16 pixels high, and header links are about 20 to 28 pixels high at 768.

A web manifest is present (name, icon, theme) and there is no service worker.

• A real phone check and add to home screen were not done. The Publish dialog has a "Mobile app" tab, which was not tested.

The plan was to export the code, unpack it, run it against my own database and re-run the 30 checks.

On Starter, 'Export project as ZIP' opens 'Upgrade Required: ZIP file export is only available on Builder, Pro, Elite and Enterprise plans', and GitHub sync is 'Included in the Builder plan and above'. The owner chose not to upgrade, so no export was run.

What Starter gives: Dashboard > Code shows and edits every file. The front end imports createClient from @base44/sdk, and every page calls base44 for log-in, data and functions, so data calls go to Base44's own servers.

Base44's support assistant said Starter has no full code download, and that the Builder ZIP has front end code, backend functions and data structure, but not data records, secrets, app users or version history. Data export is a CSV per table on Starter.

Terms of service, read on the page on 25 October 2026: section 5.3 'the Customer owns all rights, title and interest in the code and applications generated by the Platform'; section 4.2 gives Base44 'an irrevocable, non-exclusive, worldwide, royalty-free, perpetual, fully paid, sub-licensable right and license' over customer data and output, including to 'train Company software tools (e.g. artificial intelligence and machine learning models)'; section 11.5 'reserves the right, in its sole discretion, to delete all Customer Data and Generated Output'; section 10.1 'the Fees are non-cancelable and non-refundable'.

• Needs a month of Builder ($50).

One question through Help & support > Open Support Ticket, then the cancellation as the last step.

Ticket #6addfdda (category Billing) sent at 13:02 UTC on 25 October, asking whether Starter can get the full source code and data out. An AI assistant answered in under a minute, correctly and consistently with what I found, and warned it might make mistakes. No human reply by 13:29 UTC, when I cancelled; the ticket stayed open.

Cancelled at about 13:28 UTC through the dashboard: Settings, Plan & Subscriptions, the menu on the plan row, Cancel plan; a dialog listing what changes ('Keep current plan' / 'Continue to cancel'); a retention offer 'Keep building for $9 a month' (Lite), declined; a survey; 'Cancel Subscription'. No email or chat needed.

Result: 'Your plan is set to cancel on November 25, 2026. Reactivate to keep your current credits and features.' Auto Renew Off. Billing History: one invoice, 25 October, Starter, $21.77 USD, Paid; nothing further listed. No refund offered.

After 25 November, per the cancel dialog: up to 5 apps stay published, the Base44 badge returns, custom domains stop working, message credits drop to 25 a month and integration credits to 100, and code editing goes through chat only. At 13:29 UTC both https://fittingroom.test.rankdude.ai and https://fitting-room-pilates.base44.app returned HTTP 200.

• The human reply time will be read from the ticket later.

Prices were read on base44.com/pricing on 25 October 2026. The credit ledger priced everything from an empty account to the 30 checks at Starter's rate of $20 per 100 message credits.

The whole Fitting Room test used 47.62 of Starter's 100 message credits ($9.52), and 322 of the 2,000 integration credits, mostly my repeated checks of emails and backend calls.

At the limit, "actions that use credits pause until your next reset": a hard stop, not an overage bill. There is no auto top-up or credit pack, only a plan upgrade. Unused credits expire at each monthly reset (renews 25 November 2026).

Running it: Base44's published rates (docs.base44.com/Getting-Started/Credits, read 25 October) are about 1 credit per email (about 2 from a custom domain) and 1 per 100 backend calls, with database reads and writes free. 1,000 bookings a month sending 2 emails each is about 2,000 credits, or about 4,000 on a custom domain: over Starter's 2,000, inside Builder's 10,000. Stripe fees are separate.

Surprises: a prompt Base44 answered with "no code needed" still cost 1.81 credits, and Starter lacks ZIP, GitHub, branded emails, code security scanning and test data.

• A welcome offer banner showed 30% off yearly plans for 48 hours; prices change, so the date matters.