# Security scan checks User fields your rules rely on

By Steven Van · 2026-10-19

The scan lists affected fields and tables, rates them High or Medium by signup access, and Fix All locks each field to the app's editors.

Base44's security scan now flags custom User fields that data permission rules depend on but app users can edit themselves. A company field that decides which records someone sees is the example the docs give.

## Why the scan checks these fields

App users can change the custom fields on their own user profile. If an access rule relies on one of those fields, a user could set it to another organization's value and get that organization's access. The scan lists each such field under *User fields users can change*, along with the data tables whose rules read it. Expanding an issue shows the rules that read the field and what the fix does.

Issues are rated **High** if anyone can sign up for the app, and **Medium** otherwise.

## The fix

Clicking **Fix All** on the card makes the AI lock each field so only the app's editors can change it. It also moves every place the app sets the field, such as during onboarding, into a check that runs on the server.

Base44 advises testing any signup or onboarding steps that set the field, then running the scan again.

The change is part of [Base44](<https://creatorstoolbox.com/tools/base44>)'s [security scan documentation](<https://docs.base44.com/Setting-up-your-app/running-a-security-scan#user-field-access>), listed in the October 19, 2026 release notes.

![A screenshot of the User fields users can change card on the Security page, an issue expanded and the card title outlined](<https://mintcdn.com/base44/2Axbhp7o7msrez0R/images/apps-security-user-fields-users-can-change.png?fit=max&auto=format&n=2Axbhp7o7msrez0R&q=85&s=b8634e6c9d05aed0fe724736695e077b>)

A flagged issue expanded under the User fields users can change card

![Base44](<https://www.google.com/s2/favicons?domain=base44.com&sz=128>)

Base44

AI app builder — describe what you want and get a fully functional web app in seconds, no coding required.

[View Base44 →](<https://creatorstoolbox.com/tools/base44>)

[Original source](<https://docs.base44.com/changelog/product#october-19-2026>)

[Read Security scan checks User fields your rules rely on on Creators Toolbox](<https://creatorstoolbox.com/blog/base44-security-scan-checks-user-fields-your-rules-rely-on>)

---
Canonical source: https://creatorstoolbox.com/blog/base44-security-scan-checks-user-fields-your-rules-rely-on