NoCodeBackend Reviews

When I say I’m not a tech person, I mean I cannot code. But I can problem-solve, and AI has opened up a whole universe where I can use my creative brain to build useful things.

Honestly, I barely remember why I originally bought NoCodeBackend. I think I had an idea for an app, the platform I was using went under, and I saw something about secure sign-in. I did a little Googling, bought Tier 3, and then let it sit unused in my AppSumo collection until this summer.

Why mention all of that? Because I now have seven apps.

I have something to organize my day, a financial app for my aging parents, an app that helps run my business, one that stores my code, one that supports my food and wellness clients, and even an interface that lets me manage things in NCB with a few clicks. These are practical tools for real people, and NoCodeBackend has become an important part of making them work.

**What I love**

The AI table builder is a huge help. With a descriptive prompt, I can create the foundation of a database in minutes instead of trying to figure everything out from scratch.

I originally relied heavily on Google Sheets and Apps Script. My setup had become slow, clunky, and difficult to manage. Moving suitable parts into NCB, alongside Cloudflare, has made those workflows feel much more organized and responsive. I’m still migrating some pieces, but the difference has been meaningful.

Built-in authentication is another big benefit. Having a foundation for user accounts and controlled access makes building apps for other people feel much more achievable.

I’m also excited about eventually selling my apps and connecting payments to access, so I can spend less time manually managing who has paid. That is a next step for me, rather than something I have fully launched.

**Where I’d love to see improvements**

There is still a learning curve, especially coming into this without a coding background. For more involved workflows, I have needed AI assistance and additional server-side logic. Experienced developers may find those connections much more straightforward, but clearer guidance would help people like me get there faster.

The AI-generated tables need checking. In my builds, I encountered missing user-ownership fields needed for private, per-user access. More automatic checks—and clearer explanations of how authentication, user profiles, and permissions fit together—would be helpful.

Changing an existing database can also be less straightforward than creating one. I ran into restrictions when trying to modify a field already connected to authentication records. Clearer guidance about dependencies and safely changing existing tables would save troubleshooting time.

NCB already has a collection of video tutorials, including authentication, permissions, and complete app builds, which I appreciate. As someone without a coding background, I would welcome a clearly marked beginner learning path that puts those resources in order, explains the terminology, and helps me troubleshoot when my setup behaves differently from the example. That would make the existing material even more useful.

**Would I buy it again? Absolutely—and I’m upgrading.**

I started with Tier 3, and I’m excited to see NCB back on AppSumo so I can upgrade as my projects grow.

There are experienced developers here who can evaluate the technical details far better than I can. What I can offer is the perspective of someone who started without even understanding what a backend was and is now building tools that I actually use.

NCB hasn’t removed every technical challenge, but it has helped turn my ideas into working applications. Whether you already write code or, like me, are learning with AI assistance, I think this deal is well worth a look.

I purchased NoCodeBackend Tier 5 and have been spending time carefully evaluating the platform before using it for production projects.

I want to be transparent that I have not yet had enough hands-on production experience with NoCodeBackend to give a detailed review of its long-term performance or every feature. My review at this stage is primarily about my experience with the NoCodeBackend team and the level of support I have received.

I have asked their team numerous detailed questions regarding my lifetime entitlements, add-ons, account limits, future capacity, updated terms, security architecture, and other technical and business-related matters.

Their responses have consistently been prompt, detailed, thoughtful, and directly responsive to what I actually asked. When I raised more complex questions, including questions about security and the updated Terms and Conditions, they took the time to provide substantive explanations rather than generic responses.

That level of communication matters to me, particularly with a lifetime software purchase where the relationship with the company may continue for many years. I have also been impressed by their willingness to clarify lifetime entitlements in writing and provide information that I can retain for my records.

I will have a better perspective on the functionality of the platform once I have built and tested more production workloads, and I may update my review as my experience grows. For now, based on the customer service, responsiveness, transparency, and attention to detail I have experienced, NoCodeBackend has earned five tacos from me.

Keep up the great customer service.

This is honestly an amazing find. I was able to set up a database and generate APIs in less than 5 minutes! Everything is very intuitive and it feels totally worth it.

Just a few weeks ago, I was looking on Fiverr to hire a freelancer for this, but ended up putting it on hold because of the development cost. I still can’t believe I’m able to do all of this myself now! 😄

One request — I’m planning to offer this as a freelance service to my clients. It would be awesome if NoCodeBackend could eventually add a way to sell individual APIs directly to clients from the platform.

Thanks, and awesome product! 🙌

I’ve been using NoCodeBackend for a while now and I’m genuinely impressed with how much you can do without building a backend from scratch.

You get a real database, instant APIs, authentication, Row Level Security, API docs, and now MCP support for working with AI tools. It saves a LOT of development time.

What I like most is that it’s actually useful for real projects — SaaS apps, internal tools, automations, and AI workflows. I can focus on building the product instead of spending hours setting up backend infrastructure.

The team also keeps shipping new features, which is always great to see with an LTD.

My only suggestion would be to keep improving the onboarding as the platform gets more powerful.

Overall, easily one of my favorite AppSumo purchases. 🚀

UPDATE (Oct 3, 2026): Full report with timeline and evidence: https://ncb-disclosure-2026.pages.dev/

If you use NoCodeBackend, do these now:
1. Regenerate the secret key of every database (Database Settings). The vendor says it did not force a reset, so keys issued before Sept 25 keep working until you do.
2. Check your data for changes or deletions you didn't make.
3. If your databases hold your own customers' data, consider telling them it may have been readable, and check what your privacy law requires.

What was wrong
A dashboard API (/api/databases/list) returned the database list for whatever email address was in the request. It checked that you were logged in, but not that the email was yours. Signing up is free, so "logged in" was no barrier. The answer included each database's sk_live secret key: the key your app uses to read, write and delete records through the Data API. NoCodeBackend's own docs say that key is simply passed as a Bearer token. No login, no cookie.

To be precise: it exposed database keys, not dashboard logins. Those keys are what open your data.

Separately, the shared database server had port 3306 (MariaDB) open to the whole internet. Shodan, a third-party scanner, recorded it on Sept 23, before my report.

I tested only my own account and saw no one else's data. The vendor's own audit agrees: it found nothing "beyond your own isolated verification on your own account." The vendor's own description of its fix confirms the rest: it added an ownership check "so no account can ever query another user's databases."

What happened after I reported it (Sept 25, UTC)
09:36 I send a private report with reproduction steps and fixes, giving 90 days before publication.
09:45 Support: "Let our security team go over it and we will respond you back soon."
11:07 In a separate email, I ask for a refund of two prepaid add-ons bought directly from NoCodeBackend.
11:10 Support: "We don't see a any issues for the critical vulnerabilities you reported. The architecture works as expected." Refund declined.
Same day: the endpoint starts returning 403, and port 3306 is closed.
Later, in private, I'm told my "only intention was to get refund somehow," then offered a $250 coupon. I declined it.

On Sept 28, under this review, the vendor wrote: "you are 100% right on our communication," and "Replying 'we don't see any issues' while our engineering team was actively deploying the fixes was the wrong response." I appreciate that. But its Q&A answer the same day calls my report an "extreme mischaracterization" and makes claims the record doesn't support:

- "When we asked you to provide any logs or evidence... you were unable." None of the vendor's emails to me asked for logs or evidence. Only the vendor has server logs.
- I demanded a refund "within just 9 minutes." It was 91 minutes, in a separate email, after their acknowledgment. 9 minutes was their reply time.
- The refund was "well past AppSumo's 60-day refund window." I asked about add-ons bought on NoCodeBackend's own site, not on AppSumo.
- I had used it "for over 90 days" / "3 months." A comment under the same answer says "more than nine months."
- "Databases remain private, firewalled, and fully secure." Port 3306 was open to the internet until Sept 25; the vendor itself says it has since restricted it.

What's still missing
- No email to users. Keys issued before Sept 25 still work unless each user regenerates them.
- "Zero unauthorized access" over what period? They haven't said how far back their logs go, or since when the endpoint behaved this way.

Why I'm publishing
I didn't want to. If they had told users "we had a bug, it's fixed, please regenerate your keys," my private report would have been the end of it. Most buyers here aren't security specialists and can't judge this from a forum thread. The 90-day window in my report existed so the issue could be fixed; the vendor confirmed the fix publicly on Sept 28, so there's no reason to wait. The report contains no keys and nothing that identifies any other user.

On the refund: yes, I asked, after reporting, for prepaid add-ons that never reached production use. It doesn't change whether the flaw was real. The vendor's own fix shows it was. I'm not asking for anything in exchange for this review or the report.

The product
The idea is good, and the AI database setup and MCP features genuinely save time. I evaluated them on small test databases. Before this, I'd have given it 4 stars. But a backend's first job is to keep each customer's data to that customer, and how a vendor handles a reported flaw is part of the product. Until users are told, I can't recommend putting customer data here.