NoCodeBackend Reviews

I purchased NoCodeBackend Tier 5 and have been spending time carefully evaluating the platform before using it for production projects.

I want to be transparent that I have not yet had enough hands-on production experience with NoCodeBackend to give a detailed review of its long-term performance or every feature. My review at this stage is primarily about my experience with the NoCodeBackend team and the level of support I have received.

I have asked their team numerous detailed questions regarding my lifetime entitlements, add-ons, account limits, future capacity, updated terms, security architecture, and other technical and business-related matters.

Their responses have consistently been prompt, detailed, thoughtful, and directly responsive to what I actually asked. When I raised more complex questions, including questions about security and the updated Terms and Conditions, they took the time to provide substantive explanations rather than generic responses.

That level of communication matters to me, particularly with a lifetime software purchase where the relationship with the company may continue for many years. I have also been impressed by their willingness to clarify lifetime entitlements in writing and provide information that I can retain for my records.

I will have a better perspective on the functionality of the platform once I have built and tested more production workloads, and I may update my review as my experience grows. For now, based on the customer service, responsiveness, transparency, and attention to detail I have experienced, NoCodeBackend has earned five tacos from me.

Keep up the great customer service.

This is honestly an amazing find. I was able to set up a database and generate APIs in less than 5 minutes! Everything is very intuitive and it feels totally worth it.

Just a few weeks ago, I was looking on Fiverr to hire a freelancer for this, but ended up putting it on hold because of the development cost. I still can’t believe I’m able to do all of this myself now! 😄

One request — I’m planning to offer this as a freelance service to my clients. It would be awesome if NoCodeBackend could eventually add a way to sell individual APIs directly to clients from the platform.

Thanks, and awesome product! 🙌

I’ve been using NoCodeBackend for a while now and I’m genuinely impressed with how much you can do without building a backend from scratch.

You get a real database, instant APIs, authentication, Row Level Security, API docs, and now MCP support for working with AI tools. It saves a LOT of development time.

What I like most is that it’s actually useful for real projects — SaaS apps, internal tools, automations, and AI workflows. I can focus on building the product instead of spending hours setting up backend infrastructure.

The team also keeps shipping new features, which is always great to see with an LTD.

My only suggestion would be to keep improving the onboarding as the platform gets more powerful.

Overall, easily one of my favorite AppSumo purchases. 🚀

UPDATE (Oct 3, 2026): Full report with timeline and evidence: https://ncb-disclosure-2026.pages.dev/

If you use NoCodeBackend, do these now:
1. Regenerate the secret key of every database (Database Settings). The vendor says it did not force a reset, so keys issued before Sept 25 keep working until you do.
2. Check your data for changes or deletions you didn't make.
3. If your databases hold your own customers' data, consider telling them it may have been readable, and check what your privacy law requires.

What was wrong
A dashboard API (/api/databases/list) returned the database list for whatever email address was in the request. It checked that you were logged in, but not that the email was yours. Signing up is free, so "logged in" was no barrier. The answer included each database's sk_live secret key: the key your app uses to read, write and delete records through the Data API. NoCodeBackend's own docs say that key is simply passed as a Bearer token. No login, no cookie.

To be precise: it exposed database keys, not dashboard logins. Those keys are what open your data.

Separately, the shared database server had port 3306 (MariaDB) open to the whole internet. Shodan, a third-party scanner, recorded it on Sept 23, before my report.

I tested only my own account and saw no one else's data. The vendor's own audit agrees: it found nothing "beyond your own isolated verification on your own account." The vendor's own description of its fix confirms the rest: it added an ownership check "so no account can ever query another user's databases."

What happened after I reported it (Sept 25, UTC)
09:36 I send a private report with reproduction steps and fixes, giving 90 days before publication.
09:45 Support: "Let our security team go over it and we will respond you back soon."
11:07 In a separate email, I ask for a refund of two prepaid add-ons bought directly from NoCodeBackend.
11:10 Support: "We don't see a any issues for the critical vulnerabilities you reported. The architecture works as expected." Refund declined.
Same day: the endpoint starts returning 403, and port 3306 is closed.
Later, in private, I'm told my "only intention was to get refund somehow," then offered a $250 coupon. I declined it.

On Sept 28, under this review, the vendor wrote: "you are 100% right on our communication," and "Replying 'we don't see any issues' while our engineering team was actively deploying the fixes was the wrong response." I appreciate that. But its Q&A answer the same day calls my report an "extreme mischaracterization" and makes claims the record doesn't support:

- "When we asked you to provide any logs or evidence... you were unable." None of the vendor's emails to me asked for logs or evidence. Only the vendor has server logs.
- I demanded a refund "within just 9 minutes." It was 91 minutes, in a separate email, after their acknowledgment. 9 minutes was their reply time.
- The refund was "well past AppSumo's 60-day refund window." I asked about add-ons bought on NoCodeBackend's own site, not on AppSumo.
- I had used it "for over 90 days" / "3 months." A comment under the same answer says "more than nine months."
- "Databases remain private, firewalled, and fully secure." Port 3306 was open to the internet until Sept 25; the vendor itself says it has since restricted it.

What's still missing
- No email to users. Keys issued before Sept 25 still work unless each user regenerates them.
- "Zero unauthorized access" over what period? They haven't said how far back their logs go, or since when the endpoint behaved this way.

Why I'm publishing
I didn't want to. If they had told users "we had a bug, it's fixed, please regenerate your keys," my private report would have been the end of it. Most buyers here aren't security specialists and can't judge this from a forum thread. The 90-day window in my report existed so the issue could be fixed; the vendor confirmed the fix publicly on Sept 28, so there's no reason to wait. The report contains no keys and nothing that identifies any other user.

On the refund: yes, I asked, after reporting, for prepaid add-ons that never reached production use. It doesn't change whether the flaw was real. The vendor's own fix shows it was. I'm not asking for anything in exchange for this review or the report.

The product
The idea is good, and the AI database setup and MCP features genuinely save time. I evaluated them on small test databases. Before this, I'd have given it 4 stars. But a backend's first job is to keep each customer's data to that customer, and how a vendor handles a reported flaw is part of the product. Until users are told, I can't recommend putting customer data here.

Hi Sumo-lings! 👋

A useful product is great. A useful product backed by a team that keeps improving it AND actually listens? That's what gets me excited!

NoCodeBackend brings those things together, like really 🙂

The biggest win? Not having to reinvent the backend every time you want to build something..

Create your database and get automatically generated REST APIs (yes, this is free for every DB, unlimited times) and documentation instead of setting all of that up manually. For MVPs, internal tools, and app projects, that is a seriously compelling starting point. Less repetitive setup, more attention on what your application should actually do 😎

And don't let the "no-code" name fool you into thinking this SaaS is only for beginners. Built-in authentication, row-level security, and relational data capabilities make it much more interesting than a simple DB with an API attached. Making development simpler doesn't have to mean making the possibilities smaller..

The MCP integration is another standout, they even improved it several times, now they support both SSE and Streamable HTTP! 🤯

Connecting NoCodeBackend with AI development tools such as Cursor and Claude Code opens up workflows for designing schemas, managing data, and configuring your backend through natural language. That's the kind of practical AI integration I like to see .. not just another text generator bolted onto a dashboard.

But what really deserves recognition is the team behind it.

Riya, Jass, Simar, Justin .. and everyone involved, this is for you: THANK YOU! 🙏

The pace of updates has genuinely impressed me. You listen to Sumo-lings' feedback, keep improving the product, and communicate in a responsive, straightforward, no-nonsense way. Those things matter to me just as much as an impressive feature list. Also thank you for adding the native support for R2! 🙏🙏

The product gives me reasons to be interested. The team gives me reasons to stay excited. I also purchased several add-ons!

One practical recommendation for fellow Sumo-lings: check the database, record, and feature limits of your chosen tier so you pick the right fit for your projects. The offer has different allowances .. and not everything is unlimited across every plan. I suggest grabbing at least 3x Tier 5 LTD licenses here on AppSumo, as this deal is insane! 🚀🚀

My verdict? An enthusiastic 500/5 TACOS! 🌮🌮🌮🌮🌮 ... (yeah 500, not only 5, as this deal is like unreal) 😅

Sumo-lings, when you're choosing tools for your next app, don't overlook this one. NoCodeBackend deserves a serious look .. not just because of the features, but because of the people building it. And the people behind this one .. they are just amazing!

Less backend busywork. More building. THAT is this GAME-CHANGER SaaS - NoCodeBackend! 🚀

Thank you and keep shipping! 💎