On October 15, 2026, Base44 added a line to its changelog: "A public file in your file library can now be made private." Its public link stops working and the file is marked private.
That fixes the files you uploaded while building. It doesn't touch the ones your users upload. Base44's media docs say plainly that "files that people upload through your live app aren't saved to your file library," and Make private is documented only as a library action. So nothing in the docs suggests it reaches an ID scan, an invoice or a profile photo a customer sent you. Whether those are public comes down to one function call in your app's code.
TL;DR
Base44 library files are public by default, and since October 15, 2026 you can make them private. Files your users upload are a separate store: they're public if your code calls UploadFile, which Base44's SDK describes as "public storage", and private only if it calls UploadPrivateFile and serves them through short-lived signed links. Deleting the record doesn't delete a public file; its link keeps working until Customer Care removes it. Run the two checks below before anyone uploads something sensitive.
Two kinds of files, two different defaults
Here's how Base44 documents it, as of 2026-10-22:
| File library | Files your users upload | |
|---|---|---|
| Who puts them there | You, or the AI, while building | People using your live app |
| How they get stored | Uploaded in the editor | Whatever upload call your code makes |
| Default | Public: "anyone with a file's link can open it" | Public with UploadFile, private with UploadPrivateFile |
| Make private button (Oct 15) | Yes | Not documented for them; they aren't in the library |
| Deleting the record | n/a | "The file itself stays stored" |
The SDK reference spells out the difference between the two calls. UploadFile uploads "to public storage" and hands back a file_url. UploadPrivateFile uploads "to private storage that requires a signed URL to access" and hands back a file_uri instead, which on its own doesn't open anything.
That's a sensible design. The problem is that UploadFile is the obvious name, and an AI builder asked to "let users attach a document" has no reason to reach for the longer one unless you tell it to.
Check 1: which upload call does your app make?
Search your app's code for UploadFile. If you can't browse the code, ask Base44's AI chat to list every place the app uploads a file and which integration each one calls.
UploadPrivateFileeverywhere a user can attach something: good, move on to Check 2.UploadFileon anything a user might upload that you'd mind a stranger seeing: those files are in public storage.
Public storage is fine for a product photo or an avatar on a public profile. It isn't fine for a passport scan, a contract, a medical form or a CSV export. Sort each upload into one of those two buckets, because the fix only matters for the second.
Check 2: open one of the links signed out
Find a record that holds an uploaded file in the Data tab and copy the file's URL. Open it in a private browser window where you aren't signed in to Base44 or to your app.
If the file loads, so will it for anyone who gets that URL: a forwarded email, a screenshot of a support ticket, a link pasted into a chat. A public link doesn't need to be guessed to leak. It only needs to be copied once.
Deleting the record isn't the cleanup you think it is. Base44's docs say that when you delete the record that holds a user's file, "the file itself stays stored, and if it was uploaded as a public file, anyone with its link can still open it." To remove the file completely, Base44 says to contact Customer Care. The SDK reference documents no delete method, so your app can't do it for you either.
The fix: private uploads and short-lived links
Switch the upload, store the file_uri on the record instead of a URL, and create a signed link only when someone is about to view the file:
// Before: anyone with file_url can open the file
const { file_url } = await base44.integrations.Core.UploadFile({ file });
// After: store file_uri on the record; it isn't a working link by itself
const { file_uri } = await base44.integrations.Core.UploadPrivateFile({ file });
// When a signed-in user opens the record, create a temporary link
const { signed_url } = await base44.integrations.Core.CreateFileSignedUrl({
file_uri,
expires_in: 300 // seconds; 300 is the documented default
});
One thing the docs don't cover: who's allowed to call CreateFileSignedUrl. The SDK reference says nothing about permissions for it. So the signed link is only as private as the code that decides who gets one. Create it from a record the user is already allowed to read under your entity permissions, never from a file_uri passed in from the browser.
Ask Base44's AI chat to make the switch
Find every place this app uploads a file a user provides. For each one, change UploadFile to UploadPrivateFile and store the returned file_uri on the record instead of a file_url. When the app displays or downloads one of these files, generate a link with CreateFileSignedUrl using expires_in 300, and only for a record the current user is allowed to read under the existing data permissions. Don't change uploads of public images like product photos. List every file you changed.
What about files that are already public?
Switching the code protects new uploads. Files uploaded before the change stay in public storage with working links. For anything sensitive that's already out there, Base44's documented route to remove it is Customer Care.
For files in your own library, the October 15 Make private action is in the app editor: open the AI chat's Add menu, Choose from library, then More actions on the file. Two caveats from the docs before you click it. A private file can't be made public again (you'd have to upload it a second time). And copies "already loaded, for example in someone's browser, can stay viewable for a while."
Base44's security scan is free on every plan and checks data permissions, exposed secrets and functions anyone can run. Its docs don't list a check for which storage your uploads use, so run the scan and then do Check 2 by hand, because a file link that opens signed out is the quickest proof there is.
Are files uploaded to a Base44 app public?
Files in your app's file library are public by default, per Base44's docs, so anyone with a file's link can open it. Files your users upload through the live app use whichever upload call your app's code makes. UploadFile puts them in public storage, and UploadPrivateFile puts them in private storage that needs a signed link.
Does Make private in Base44 cover files my users upload?
No. Base44 added Make private for file library files on October 15, 2026. Its docs say files people upload through your live app aren't saved to your file library, and they describe no way to make an existing user upload private. Those files are private only if your code uploads them with UploadPrivateFile.
If I delete a record in Base44, is the uploaded file deleted too?
No. Base44's docs say the file itself stays stored, and if it was uploaded as a public file, anyone with its link can still open it. To delete the file completely, Base44 says to contact Customer Care.
How long does a Base44 signed URL last?
CreateFileSignedUrl takes an optional expires_in value in seconds, and Base44's SDK reference lists the default as 300, which is five minutes. You can pass a longer value, but a shorter link is a smaller window if it gets shared.
Built on Base44?
Scan your live app for exposed keys, open files and missing headers in a couple of minutes.