There Is a Discord Called “Base44 Refugees”. There Is No Such Thing for Hyperlambda.

Part of the honest comparison series — see also Unqork, Magic vs Directus, and Open Source AI App Builders Compared.

There is a Discord server called Base44 Refugees. There is a commercial service called escapebase44.com whose entire business is moving people off the platform, and which advertises 120 apps migrated. There is a GitHub project called base44-to-supabase-sdk, a "universal drop-in replacement SDK for Base44 projects," shipping a self-hosting guide.

And there is this sentence, live on Base44's pricing page today:

"Yes. You own everything you build on Base44: your code, your data, your users. Two-way GitHub sync exports the full source code to your own repo at any time. Nothing is locked to the platform."

Both of those things cannot be true. This article is about which one is.

First, credit where it is due

Base44 was built by Maor Shlomo, alone, without venture funding, and sold to Wix roughly six months later for $80 million in cash plus up to $170 million in earn-outs running through 2029. That is one of the most impressive solo outcomes in the history of this industry and I am not going to pretend otherwise.

The product is real, too. It is not a demo. Base44 ships a managed backend: a MongoDB-compatible database with entities, built-in authentication including Google, Microsoft, Facebook and Apple, Deno-based serverless functions, OAuth connectors, row-level and field-level security rules, and SPA hosting with custom domains and automatic HTTPS. You describe an app in English and you get a working one, backend included. For a non-technical founder validating an idea this afternoon, it is genuinely excellent and considerably smoother than anything I make.

So the criticism below is not that Base44 is bad. It is that one specific claim on their pricing page is not true, and that the gap between that claim and reality is where your business lives.

What the export button actually does

Base44's GitHub integration works. Your code syncs to your repository. You can read it, edit it, commit it.

What syncs is the frontend.

Their own developer documentation describes the rest plainly. The database is Base44's. Authentication is Base44's. Backend functions run as Deno serverless in Base44's runtime. Custom integrations are, in their words, "proxied through Base44's backend, so credentials are never exposed to the frontend." Every one of those is reached from your exported code through the Base44 SDK.

So the exported repository is a React application that makes calls to a backend you cannot export, cannot self-host, and cannot run. Cancel your subscription and what you own is a folder of code that calls an API you no longer have access to.

Migration does not mean moving. It means rebuilding your backend somewhere else and repointing the frontend at it — which is precisely why a paid service exists to do that for people, and precisely what that service advertises:

"Migrate your whole app off Base44: the frontend, backend, database, users, and the code Base44 keeps hidden, onto infrastructure you own."

Read that last clause again. The code Base44 keeps hidden. That is a third party, charging money, describing the same platform whose FAQ says nothing is locked in.

Their landing page puts your-app.base44.app under the label "BASE44'S" and your-app.com under the label "YOURS". One of their testimonials, from an attorney, reads: "The site is live, the escape worked." Another, from a builder called suzuki: "All the ease of building with base44, minus the headache once the app gets complex enough that you want to be able to access the backend and do things directly."

I could not have written a better description of the problem if I had been paid to.

The test that actually settles it

Here is the only question that matters, and it applies to every platform in this category including mine:

If you stopped paying tomorrow, would your application still run?

For Base44, no. The frontend is yours; the half that holds your data, your users and your logic is not.

For Magic Cloud, yes, and not because I am generous. The entire platform is MIT licensed — runtime, database layer, code generation, auth, RBAC, dashboard, the lot. What the generator writes is Hyperlambda, which is text on disk that you can read, diff and commit, executed by a runtime you already have a copy of. Leaving is not a migration project. It is docker compose up somewhere else.

That is why there is no escapehyperlambda.com. Not because nobody would want one — because there is nothing for it to do. You cannot build a migration industry around copying a folder.

When Base44's authentication broke, every customer could only wait

On 9 July 2025, Wiz Research disclosed an authentication bypass affecting private Base44 applications.

The exploit required one piece of information: the app_id — which was publicly visible in app URLs and manifest files. Two undocumented endpoints, for registration and for OTP verification, had no authentication on them at all. Supply the app_id and you could register a verified account on somebody else's private application, bypassing SSO entirely.

Wiz confirmed the bypass against real enterprise applications built on the platform: internal chatbots, knowledge bases, and PII and HR operations.

Wix patched it within 24 hours and found no evidence of exploitation. That is a genuinely good incident response and it deserves to be said clearly.

But the bug is not the point. Every platform has bugs; mine included. The point is this:

Not one Base44 customer could have found that flaw, prevented it, audited for it, or patched it. They did not write that authentication code. They cannot read it. They could not have fixed it if they had noticed. They learned about it from a security company's blog post, and then they waited.

This is the same failure shape I wrote about when an AI agent deleted a stranger from a gym waitlist — an endpoint that trusted whoever called it. The difference is that the gym could fix their endpoint. A Base44 customer cannot, because the endpoint is not theirs.

On Magic, authentication is a slot invocation in a file in your cloudlet. You can read it, test it, change it, and if you find something wrong at four in the morning you can fix it at four in the morning. That is not a feature. It is just what owning the runtime means. The related argument about constraining what generated code can do lives in runtime whitelisting, and there is a standing bounty on breaking it that nobody has collected.

Two meters, both running

Base44 bills on credits, and there are two kinds.

Message credits are spent when you talk to the AI to build or change your app. Integration credits are spent by your users, in production: emails sent, API calls made, AI agent runs, file uploads, automations, backend tasks, image analysis.

Plan	Price (billed annually)	Message credits	Integration credits
Free	$0	25/mo	100/mo, max 5 apps
Starter	$16/mo	100/mo	2,000/mo
Builder	$40/mo	250/mo	10,000/mo
Pro	$80/mo	500/mo	20,000/mo
Elite	$160/mo	1,200/mo	50,000/mo

Three details that are easy to miss:

Both credit types expire monthly and do not roll over. There are public feature requests on Base44's own feedback site asking for this to change.

There are no credit top-ups. Run out in week three and the remedy is not a small one-time purchase, it is upgrading your entire plan.

SSO is Enterprise-only. The tier list above tops out at $160/mo, and single sign-on is not on it at any price.

The structural problem is the second meter. Integration credits mean your application's success costs you money in a way that has nothing to do with compute. Every email your users trigger, every API call your app makes on their behalf, is metered against a monthly allowance that expires. Past 50,000 of them the only door is a sales conversation.

Magic is $100 per month for a managed cloudlet, published on the pricing page. Unlimited users. No message meter on building, because the generator is yours. No integration meter on running, because your app's traffic is your app's traffic. Nothing expires. Or self-host it on a $12 droplet and pay me nothing at all.

The database nobody mentions

From Base44's documentation, presented as a convenience:

"Schemas are not enforced, so you can update your data model at any point without running migrations."

For a prototype, that is genuinely pleasant. For a business, it means there is no referential integrity, no constraints, and nothing stopping the shape of your data drifting silently over months. Invoices that reference customers who no longer exist are not a hypothetical failure mode of schemaless document stores; they are the characteristic one.

Magic runs on SQLite, MySQL, PostgreSQL and SQL Server, with real schemas, real constraints and real transactions. And — the part Base44 has no answer to at all — it can wrap the database you already have. Base44 requires you to build on theirs, which means there is no path at all for the twenty-year-old system your company actually runs on. That is the entire subject of Legacy Modernization.

Where Base44 genuinely wins

No rebuttals in this section. That is the rule of this series.

Ease, by a distance. A non-technical person can ship a working app on Base44 in an afternoon. Is Magic as easy for that person? Honestly, no. Magic is built for developers, and for non-developers working through an AI agent. If you have never written code and you want something live today, use Base44.

Frontend quality. Base44 produces polished, responsive interfaces with a visual editor. Magic's frontends are generated as HTML and JavaScript by the agent, with no component library and no visual canvas.

Integrations out of the box. Gmail, Slack, Notion, Google Drive, HubSpot, Salesforce, Stripe, wired up without configuration. Magic has OpenAPI import and a headless browser, which is more general and less convenient.

Zero operations. No droplet, no Docker, no domain configuration. That has real value and it is honest to say so.

Incident response. Twenty-four hours from disclosure to patch, publicly confirmed, is better than most companies manage.

The comparison, condensed

Conceded rows first, as always in this series.

	Base44	Magic Cloud	Verdict
Time to a working app	Minutes, nothing to set up	Longer — a cloudlet to stand up first	Base44 wins
Ease for non-developers	Excellent	A developer tool, and honest about it	Base44 wins
Frontend generation	Polished UI, visual editor	HTML and JS from the agent, no canvas	Base44 wins
Pre-built integrations	Gmail, Slack, Notion, Drive, HubSpot, Salesforce, Stripe	OpenAPI import and a headless browser	Base44 wins
Operations burden	None whatsoever	Yours, or $100/mo managed	Base44 wins
Runtime ownership	Frontend exports; backend cannot be exported	MIT, entire stack	Magic wins
Self-host / on-prem	Not possible	Yes, anywhere a container runs	Magic wins
If you stop paying	The app stops	The app keeps running	Magic wins
Price shape	Two credit meters, monthly expiry, no top-ups	$100/mo flat, or free self-hosted	Magic wins
Your app's traffic	Metered	Not metered	Magic wins
Users	Counted	Unlimited	Magic wins
Database	NoSQL, schemas not enforced	4 relational engines, real constraints	Magic wins
Your existing database	No path	Wrap it as-is	Magic wins
Auth	Theirs; unreadable, unpatchable	A file you can read and change	Magic wins
SSO	Enterprise tier only	8 OIDC providers included	Magic wins
Generated backend code	Behind the SDK	Readable files, diffable, in git	Magic wins
AI code sandbox	None	Whitelisted runtime, throws at dispatch	Magic wins
MCP server	No	Role-filtered, every endpoint a tool	Magic wins
Hosting	SPA only, no SSR	Backend, static and SPA	Magic wins

Five rows to Base44, fourteen to Magic — and the five it takes are the five that decide whether you ship this week. Read the column with that in mind rather than counting it.

The decision rule

Use Base44 if you are not technical, you want something live this afternoon, the app is a prototype or an internal tool whose disappearance would be survivable, and the convenience is worth the dependency. That is a perfectly rational trade and a lot of people should take it.

Use Magic if the application is the business. If the answer to "what happens if this vendor changes its pricing, its terms, or its mind" has to be "nothing," then you need the runtime, not just the repository.

And you can use both. A Base44 or Lovable frontend calling Magic's REST endpoints is a perfectly sensible stack — you get the visual builder where it helps and keep the half that holds your data on infrastructure you own. Magic publishes OpenAPI specifications; any generated frontend can call them like any other API.

The fine print

Every Base44 figure here was read from their own pricing page, developer documentation and FAQ on the day of publication, and pricing pages move — re-verify before quoting me. The escape-service details, including the 120-app figure and the quoted testimonials, are that company's own public claims, not numbers I have audited; I am citing them as evidence that the market behaves as though lock-in exists, which is the argument, rather than as verified migration statistics. The vulnerability details are from Wiz Research's public disclosure and Wix's confirmed response.

I have not built a production application on Base44. The criticisms above are architectural, drawn from what their documentation says the platform does, not from a frustrated afternoon.

And the obvious disclosure: I wrote Hyperlambda and I sell Magic hosting. Read the comparison table accordingly. I have tried to make every factual claim checkable precisely because I am not neutral — go and check, and tell me if I have got something wrong.

Frequently asked questions

Can you export your code from Base44?

Partly. Base44's two-way GitHub sync exports the frontend source code to your own repository. The backend — database, authentication, serverless functions and proxied integrations — is not exportable and cannot be self-hosted. The exported frontend reaches all of it through the Base44 SDK, so it does not run independently of Base44's infrastructure.

Is Base44 vendor lock-in?

By the practical test, yes: if you stop paying, your application stops working, and moving off the platform requires rebuilding the backend elsewhere. A commercial migration service and a "Base44 Refugees" Discord community both exist for that reason. Base44's own FAQ states that nothing is locked to the platform.

Who owns Base44?

Wix, which acquired it in June 2025 for approximately $80 million in cash with up to $170 million in earn-outs through 2029. It was founded and built by Maor Shlomo without venture funding.

What was the Base44 security vulnerability?

In July 2025, Wiz Research disclosed an authentication bypass in which undocumented registration and OTP-verification endpoints allowed anyone holding a publicly visible app_id to create a verified account on a private application, bypassing SSO. Wix patched it within 24 hours and reported no evidence of exploitation. Customers had no ability to detect or fix it themselves.

How much does Base44 cost?

Plans run from free to $160 per month billed annually, metered by two separate credit types: message credits for building and integration credits consumed by your live application. Both expire monthly without rollover, there are no top-ups, and SSO requires an Enterprise contract. Magic Cloud is $100 per month flat with no metering, or free self-hosted under MIT.

Can I use Base44 for the frontend and Magic for the backend?

Yes. Magic exposes real REST endpoints with OpenAPI specifications, so any generated frontend can call them. That combination gives you a visual builder for the interface while your data, users and business logic stay on infrastructure you own.