Vibe code a real app on Base44

By the end of this track you will have

1. Step 1A plan Base44 wrote and you corrected, naming every table, field, role and page, with your one sentence at the top, before a line of the app exists.
2. Step 2One working screen built from one plan item, and one revert done on purpose before you need it.
3. Step 3App visibility set on purpose, one sign-in method on, and a written rule on every table and every private field.
4. Step 4The one thing your app sends through an outside service running in a backend function that checks who asked, and its key kept in Secrets.
5. Step 5The Testing Agent and the Security Scan run, every finding answered, the app live on your own domain, and the pages you want found carrying the description you wrote.

The steps

Each one ends with a check you run yourself. The box is yours to tick when it passes.

1. 1
   Step 1.Make it plan before it builds

   45 minutesOpen to everyone

   Done means

   The plan on screen holds your sentence word for word, every table with its owner, and every role. Start Building has not been clicked. What the planning cost is written down: the Message credits used figure before your first plan message, the figure after your last, and the difference between them. If a table is missing its owner, or the sentence has been reworded, the plan is not finished.

   The check passed
2. 2
   Step 2.Build one screen, then prove you can go back

   60 minutes

   Done means

   Your register holds the time of version A and the message that made it. You reverted to version A, and the screen showed the earlier state. You reverted to the latest version, and the screen showed that. Both matches are written down as you saw them. If you ticked a match without looking at the screen, you have not done the step.

   The check passed
3. 3
   Step 3.Lock every table before the first stranger signs in

   75 minutes

   Done means

   Acting as test customer two, or signed in as them in a private window, their page shows their own test row and not test customer one's. The admin account sees both. Each table's Permissions page matches the sentences on your sheet. The Security Scan lists no data permission issue. If customer two can see customer one's row, stop there, fix the rule, and run the whole proof again.

   The check passed
4. 4
   Step 4.Put secrets and sending behind a function that checks who asked

   90 minutes

   Done means

   The Security Scan shows no Anyone can run this function issue and no Exposed secrets issue. The browser search for the first six characters of your key finds 0 matches. With your own number on a test customer's row, one press sends one message to that phone, about that row. Logs shows the Function Call, with the account that pressed it in the User column. After publishing, every one of those gives the same answer on the live app. Any match in the search means the key is out. Make a new one at the provider before anything else.

   The check passed
5. 5
   Step 5.Run the checks, then publish on your own domain

   60 minutes

   Done means

   The Security Scan shows no open finding rated High or Critical, or your register holds a written reason beside each one. The Testing Agent passes your three named flows. Sign-in is not one of them, because the agent cannot test it, so you did it by hand. In a private window on your own domain, the public pages load and the private ones send you to sign-in. View page source on three public pages shows, word for word, the description you typed for each in SEO & GEO, Meta tags. With fewer than three public pages, that holds for every one you have. If the domain is still waiting on DNS, the last two checks wait with it. Nothing else does.

   The check passed