Static analysis has a ceiling, since code scanning surfaces risky patterns in your source but can't tell you whether your auth actually holds, whether data access controls survive real probing, or whether your business logic breaks under sustained pressure. Runtime behavior is the harder problem, and it's the one that decides whether an app is production-ready.
Agentic penetration testing closes that gap: an AI pentester runs live exploitation attempts against your published app's running version, the same way a human red team would, and reports what it actually managed to do. It's now built directly into Base44, as a second, adversarial layer on top of Base44's app security scanning.
TL;DR: agentic penetration testing on Base44
- Real attacks on your live app: an AI pentester goes after your published app and adds attack testing on top of code scanning
- Connect once: add your Tenzai access key to the workspace once, then start pentests from each app's Security page
- Builder plan and above: the same tier as the rest of the app security scanning suite
- Built for published apps: the app needs a published build and an up-to-date code scan, and one pentest runs at a time
- Get started: connect Tenzai, paste your key and hit “Run penetration test”
[Run agentic pentests on your Base44 app (#)] · Read the docs
What is agentic penetration testing?
Agentic penetration testing uses an AI pentester to actively attack a live, running application the way a human adversary would, rather than statically analyzing its code. On Base44, that pentester is Tenzai, triggered from the app's Security page.
Run an agentic pentest on your live app
Tenzai is rolling out to your workspace's Connectors gallery. Once it's connected, your published apps get a pentest button on their Security page. Press it and Tenzai's AI pentester goes after the live app like a real adversary would, then reports what it managed to do.
01. See what an attacker can do on your live app
Because Tenzai runs against the running app, its findings show what an attacker could actually reach. That's the part a code scan can't show you on its own: how your app holds up when someone actively tries to break it.
02. Connect once, then test from each app
Connect your workspace with a Tenzai access key one time. From then on, any published app with an up-to-date code scan can start a pentest from its Security page. Only workspace admins can start a test, and one run can be active at a time.
03. How Tenzai pentests your app safely
To test the app, Tenzai signs in with a scoped test login that it gets by accepting an invitation to the app. Tenzai never receives your own login details, and your access key is stored encrypted and never shown again after you paste it.
04. Where your pentest report lives
The full findings report goes to your Tenzai account, where your security team can review it. Billing runs through your Tenzai account at your Tenzai plan's pentest rate, so your Base44 credits stay untouched.
Why AI-built apps need penetration testing
Tenzai ran its own security research on Base44 to see how much model choice changes an app's security. Testing 15 apps built from the same prompts across five different AI models, Tenzai's agent found 254 vulnerabilities total, with the type and severity shifting significantly by model (source: Tenzai, “Five models walk into an app builder, security gets interesting”). This integration closes that same blind spot for your own apps.
Agentic pentesting vs code scanning
Your code scan catches issues in the source before they reach a live app, and a pentest shows how the published app holds up under a real attack. A vulnerability scan checks for known patterns and misconfigurations, often without confirming they're exploitable; a penetration test, like Tenzai's, actively tries to exploit what it finds and reports what actually worked. Put the two together on one Security page and you get a clearer answer when someone asks if you can trust what you built. For the fuller picture of how Base44 protects published apps, see our guide to application security.
Best practices for pentesting a Base44 app
- Run a code scan first: the pentest needs an up-to-date scan, so fix what it finds before you start
- Test after meaningful changes: new auth flows, roles or data access are good moments for a fresh run
- Pentest what's published: Tenzai tests the published build, so publish the version you want tested
- Loop in your security team: they'll work from the findings report in Tenzai
How to run a penetration test on Base44
- Connect once per workspace: open Connectors in your workspace and find Tenzai. If you're new to Tenzai, sign up first. Registering from Base44 walks you through Tenzai's guided onboarding for Base44 workspaces, where you accept an invitation and get a dedicated Tenzai organization plus an access token for Base44.
- Paste your access key: add your Tenzai account's access key. It's stored encrypted and never shown again. There's a register link right in the dialog if you still need an account.
- Run a pentest from your app's Security page: as a workspace admin, make sure the app is published with an up-to-date code scan, then hit “Run penetration test.” Tenzai signs in with a scoped test login and starts on the live app. When the scan completes, the full report arrives in your Tenzai account and “Go to Tenzai” takes you straight there.
[Run agentic pentests on your Base44 app (#)]
Agentic penetration testing FAQ
Does Base44 have security features for apps you build on it?
Yes. Builder-plan workspaces and above get code-level security scanning on every app's Security page, and can add Tenzai's agentic penetration testing on the same page, which attacks the published, running app rather than its source.
Can AI replace human penetration testers?
Not entirely. An AI pentester like Tenzai is faster and can run on demand, which is why it fits naturally into a workflow like publishing an app. Human testers still bring judgment on novel attack ideas and deep business-logic review that a scheduled or one-off engagement is built for.
Which plans include the Tenzai integration?
The Builder plan and above, the same plans that include the rest of the app security scanning suite.
Who can start a pentest?
Workspace admins and owners. The Tenzai connection is set up once at the workspace level and only admins can trigger a test.
Which apps can I test?
Published apps with an up-to-date code scan. Fullstack apps aren't supported, and one pentest can run at a time.
Does Tenzai get my credentials?
Tenzai never receives your own login details. It signs in with a scoped test login from an invitation it accepts.
How is a pentest billed?
Through your Tenzai account at your Tenzai plan's pentest rate. Running a pentest uses zero Base44 credits.
Where do I see the results?
In your Tenzai account. When a scan completes, “Go to Tenzai” on your app's Security page takes you straight to the full findings report.
Do I need a Tenzai account first?
Yes, to get an access key. You can register from Base44, which gives you a dedicated Tenzai organization and an access token through Tenzai's guided onboarding.
Is it safe to run a pentest on my live app?
Tenzai tests your published app with a scoped test login and never receives your own credentials. As with any active test against a production app, plan around real user traffic the way you would for any other live change.