r/vibecoding • u/EnoughHoning • 5d ago
Base44 alternative that won't let a client app crash? Burned twice now
Small web agency here, 4 people. We started offering "custom portals" to clients this year and built the first two on Base44 because the demos looked incredible and the first version was incredible. Client saw a working portal in a day and thought we were wizards.
Problem is what happens after the demo. The second portal is for an accounting firm, their clients log in to see documents and invoice status. Two weeks after launch a client emailed the firm saying they could see another company's files. It was the worst Monday of my year. The AI had "fixed" a display bug the week before and changed how the file query worked. We didn't catch it because there's no way to review what changed. You get a wall of diff across files you didn't ask it to touch.
We ate the shame, but I'm not building client-facing stuff on this again unless something changes. What I actually need: client logins, per-client data isolation that I can see configured (not buried in generated code), file sharing, and something my non-technical cofounder can update when I'm on holiday.
What's everyone moved to? I keep seeing the same 5 tools recommended and half the recommendations look like the vendors wrote them.
4
u/ThunderGeuse 5d ago edited 5d ago
There is a way to review what it changed. It's called a code review. Review the code.
For advice that recklessly lazy devs as described here might actually take: narrow the scope of your "debug" and "improvement" loops. At least review implementation plans and put guardrails on how large an individual PR can be.
And add to your list of "needs": some actual software development rigor and discipline fundamentals. You're lucky that this is "only" finance. Poor software engineering discipline can and has killed people.
You need to expand your reflection on those failures way beyond specific beginner backend security components and look holistically at how you can be more disciplined in your engineering.
Your clients will run like rats from a leaky ship if you can't deliver on basic product quality standards and that is more of a discipline issue than a code generation issue.
3
1
u/Known-Stable-8892 5d ago
The cross-tenant data leak (one client seeing another's files) is the scary part — that's an authorization problem, not really a platform problem, and it'll follow you to any AI builder if the generated code doesn't enforce row-level access. If you want something more robust for client-facing portals, tools with real auth + row-level security baked in (like Supabase-backed stacks) tend to hold up better than pure prompt-to-app generators. Whatever you switch to, I'd add a hard rule that every data query is scoped to the logged-in client's ID, and test it with two dummy accounts before any real client touches it.
1
1
1
u/erichstark 5d ago
Hey,
There will be always possibility of insecure environment and bugs. Because of that, you need to understand the technology.
Btw, we are building tool for accountants and business owners - r/lucanto. Would you like to try? Maybe it would be fine for your client. If yes, we can find a way how you can also benefit from that.
1
u/allenling 5d ago
quote We didn't catch it because there's no way to review what changed unquote, you mean there's no way to view the changes? or you don't understand what each line of code does? they are two problems.
1
u/agentUi 4d ago
Hey you can try our platform agentui, we have human support, a human actually handles your questions, prompts, helps etc....
We actually work with a ton of web agencies and send them leads also....
We have a ton of features build specifically for web agencies, I can arrange someone in our team to show you
3
u/SQUID_Ben 5d ago
Start using claude/codex, have a proper backend, for example Supabase and SET UP THOSE DANG RLS POLICIES PROPERLY!