Security OS · GrowEFX + INCLUZION CO · May 2026

Website
Security
Maximum

Research-grounded security framework for growefx.com, incluzionco.com, and all Base44 apps. From the immediate critical fix to the full protection stack — in priority order.

Immediate threats1 Critical · 3 High
Fix time (critical)15 minutes
Recommended stackCloudflare Free + Base44 hardening
Cost at max protection$0–$20/mo
Market contextCDN security $12.1B in 2026
Priority Order · Fix Now
4 issues. 15 minutes. Do these first.

The Base44 security dashboard showed 1 Critical and 3 High issues on the INCLUZION app. These must be resolved before the calculator goes live and before any GRIP posts drive traffic to the domain. In order of priority.

🔴 Critical · Fix in 5 min
Exposed Base44 API Key in pages/Index.jsx

The API key is hardcoded directly in client-side code. Anyone who views the page source in a browser can steal it — then read, modify, or delete your entire Base44 database including Contacts, affiliate records, and payment data. This is the #1 vulnerability in AI-generated apps (confirmed by Rafter, ShipAI, and Base44 security docs). 67% of AI-built codebases have at least one critical vulnerability — this is it.

Fix: Move key to Base44 environment variables → reference as process.env.BASE44_API_KEY → redeploy → confirm page still functions → verify key no longer visible in page source.
🟠 High · Fix in 5 min
calcKeywordWebhook — No Signature Verification

This function accepts incoming webhook data from ManyChat without verifying the request is actually from ManyChat. Any attacker who discovers the URL can flood it with fake CALC triggers, creating thousands of fake Contacts records, exhausting your Base44 quota, and poisoning your lead data before the campaign starts.

Fix: Add webhook secret header check at the top of the function. Request must include matching secret or return 401. Generate secret in ManyChat settings → store in Base44 env vars → verify in function.
🟠 High · Fix in 3 min
calcFollowUpCheck — No Admin Auth

Marked as "Admin-only" in the app but lacks the actual authentication check that enforces it. The label is not the protection — the code is. Any caller who knows the function URL can invoke it, triggering follow-up DMs to your entire contact list on demand.

Fix: Add admin token verification at the function's first line. Reject any request without a valid Authorization header containing the admin token.
🟠 High · Fix in 2 min
sendConfirmationEmail — Publicly Invokable

This function can be called by any user without authentication. Anyone can trigger bulk confirmation emails from your domain to any address — a classic spam abuse vector that gets your domain blacklisted within hours of exploitation.

Fix: Restrict to internal-only calls. Add the same admin token check as calcFollowUpCheck. This function should never be callable from a public URL.
🟢 Low · Fix when convenient
Missing Permissions-Policy Security Header

Security header that restricts which browser features your app can access. Not exploitable in isolation but hardens the app against feature misuse. Base44 has a one-click "Fix" button for this in the Security dashboard.

Fix: Click the Fix button in the Security dashboard for this item. Takes 10 seconds. No code changes required.
Do not post the FRI_0529 IncluzionCo carousel or activate the CALC keyword until the Critical issue is resolved. The API key in the page source means every visitor who clicks through from a post to incluzionco.com can see your database credentials. Fix the key first — it takes 5 minutes — then all 4 GRIP posts this week are clear to deploy.