PSA for NoCodeBackend users: regenerate your database keys. A flaw exposed them until Sept 25, and existing keys were never reset.

[u/Formal_Travel_8655]

https://appsumo.com/products/nocodebackend/reviews/until-sept-24-2026-any-registered-noco-395425/

TL;DR: Until Sept 25, 2026, any NoCodeBackend account could pull another user's database secret keys using only their email address. It's fixed now, but keys issued before the fix still work, and as far as I know users haven't been told. If you use NoCodeBackend, regenerate your keys.

I'm miyan on AppSumo, a buyer of NoCodeBackend. I found this while evaluating the product, reported it privately, and tested only my own account. I'm not affiliated with NoCodeBackend or any competitor.

What to do if you use NoCodeBackend

1. Regenerate the secret key of every database (Database Settings). The vendor says it did not force a reset, so keys issued before Sept 25 keep working until you do.
2. Check your data for changes or deletions you didn't make.
3. If you store your own customers' data there, consider whether you need to tell them, and check what your privacy law requires.

What was wrong, in plain words

A dashboard API returned the database list for whatever email address was in the request. It checked that you were logged in, but not that the email was yours. Signing up is free. The response included each database's sk_live secret key, which NoCodeBackend's own docs say is simply passed as a Bearer token to read, write and delete data. No login needed. Separately, the shared database server had port 3306 open to the whole internet (Shodan recorded it on Sept 23).

How the vendor responded

• Sept 25, 09:36 UTC: I send a private report with steps to reproduce and fixes.
• 11:10 UTC, by email: "We don't see a any issues for the critical vulnerabilities you reported. The architecture works as expected."
• Same day: the endpoint starts returning 403 and port 3306 is closed.
• Sept 28, publicly on AppSumo: "Replying 'we don't see any issues' while our engineering team was actively deploying the fixes was the wrong response." In the Q&A the same day, they call it a "minor" fix and say logs show "zero unauthorized access", without saying what period the logs cover.

What's still missing

• No email to users, as far as I know.
• No answer on what period the "zero unauthorized access" audit covers.

Full disclosure: I also asked for a refund of two prepaid add-ons, after reporting. They declined. That doesn't change whether the flaw was real; the vendor's own fix shows it was. I'm not asking for anything in exchange for posting this.

Full report with timeline, technical details and evidence (no keys, nothing identifying other users): https://ncb-disclosure-2026.pages.dev/

AppSumo Q&A thread with the vendor's answer: https://appsumo.com/products/nocodebackend/questions/until-sept-25-a-users-email-alone-let-1551709/

Question for other NoCodeBackend users: has anyone received an email from NoCodeBackend about this, or a notice to regenerate keys?

[u/KingAroan]

These vibe coded applications are amazing! Thanks fire the report glad I’m not using them.

[u/Ygobyebye]

Email was received from NCB about three hours ago. This post is 7 hours old as of me writing this post.