Security scan findings - Base44 Support Documentation

The app.security.check_run audit event stores a summary of an app security scan. When the event includes a run_id, use it to retrieve the sanitized, ownership-scoped findings for that run. See Event Types for the event and its metadata fields.

The audit event

This event contains scored dependency and static-code findings, plus unscored RLS, hardcoded-secret, and backend-function findings. ClickHouse stores every metadata value as a string, including counts:

{
  "timestamp": "2026-07-26T14:32:18Z",
  "user_email": "security.admin@example.com",
  "workspace_id": "67f2c8e01a3b5d004e92d7a1",
  "app_id": "6820f3a4e7b91d003c45a1f2",
  "ip": "203.0.113.42",
  "user_agent": "Mozilla/5.0",
  "event_type": "app.security.check_run",
  "status": "success",
  "error_code": "",
  "metadata": {
    "run_id": "6886b8d390dc7e2f4a2c91b3",
    "findings_total": "5",
    "highest_scored_severity": "high",
    "critical_findings_count": "0",
    "high_findings_count": "1",
    "medium_findings_count": "1",
    "low_findings_count": "0",
    "unscored_findings_count": "3",
    "rls_recommendations_count": "1",
    "hardcoded_secrets_count": "1",
    "backend_functions_issues_count": "1",
    "dependency_vulnerabilities_count": "1",
    "static_code_findings_count": "1"
  }
}

Dependency and static-code findings can have a scanner-provided severity. RLS recommendations, hardcoded-secret findings, and backend-function issues are unscored. highest_scored_severity considers only scored findings and is none when no finding has a recognized severity. Never infer a severity for an unscored category. static_code_findings_count can be absent when the static scanner did not run. An absent key does not mean that the scanner completed with zero findings.

Retrieving findings

Send the event’s run_id to Get security scan findings, scoped to the workspace in the URL:

curl --request GET \
  --url https://app.base44.com/api/v1/audit-logs/67f2c8e01a3b5d004e92d7a1/security-scan-runs/6886b8d390dc7e2f4a2c91b3 \
  --header 'api_key: <api_key>'

The request needs a workspace API key with the AUDIT_LOGS_READ (audit_logs:read) scope. The lookup is scoped to the workspace in the URL, so a run owned by another workspace is not found. The list endpoint never hydrates events with findings and has no include_security_findings option. Its cursor, page limit, and truncation behavior are unchanged. Events without a run_id, and events whose referenced run is no longer available, remain summary-only.

What the response contains

Get security scan findings documents the full response schema. Each section uses a strict field allowlist. Responses exclude source snippets, evidence, full RLS expressions, secret values or secret-matching text, input hashes, scanner prompts and models, internal user identifiers, and internal-only URLs.

Interpreting coverage

The coverage object reports the outcome for all five scan sections. Treat a section’s empty findings array as a clean result only when its coverage is completed:

Value	Meaning
`completed`	The section ran to completion. An empty findings array is a clean result only with this value.
`failed`	The section failed. Its findings array must not be treated as clean or complete.
`not_run`	The section did not run. Its findings array must not be treated as clean or complete.
`unknown`	The outcome is unavailable. It must never be treated as clean or successful.

When the event metadata contains coverage_incomplete with the string value "true", treat findings_total as a floor. Fetch the run and inspect coverage to identify the incomplete sections. Coverage is evaluated independently for rls, hardcoded_secrets, backend_functions, dependency_vulnerabilities, and static_code. For example:

{
  "run_id": "6886ba43a165272b97b80322",
  "app_id": "6820f3a4e7b91d003c45a1f2",
  "workspace_id": "67f2c8e01a3b5d004e92d7a1",
  "created_date": "2026-07-26T15:04:09Z",
  "coverage": {
    "rls": "completed",
    "hardcoded_secrets": "failed",
    "backend_functions": "not_run",
    "dependency_vulnerabilities": "completed",
    "static_code": "unknown"
  },
  "rls_recommendations": [],
  "hardcoded_secrets": [],
  "backend_functions": [],
  "dependency_vulnerabilities": [],
  "static_code_findings": []
}

​The audit event

​Retrieving findings

​What the response contains

​Interpreting coverage

The audit event

Retrieving findings

What the response contains

Interpreting coverage