NoCodeBackend Reviews

This is honestly an amazing find. I was able to set up a database and generate APIs in less than 5 minutes! Everything is very intuitive and it feels totally worth it.

Just a few weeks ago, I was looking on Fiverr to hire a freelancer for this, but ended up putting it on hold because of the development cost. I still can’t believe I’m able to do all of this myself now! 😄

One request — I’m planning to offer this as a freelance service to my clients. It would be awesome if NoCodeBackend could eventually add a way to sell individual APIs directly to clients from the platform.

Thanks, and awesome product! 🙌

I’ve been using NoCodeBackend for a while now and I’m genuinely impressed with how much you can do without building a backend from scratch.

You get a real database, instant APIs, authentication, Row Level Security, API docs, and now MCP support for working with AI tools. It saves a LOT of development time.

What I like most is that it’s actually useful for real projects — SaaS apps, internal tools, automations, and AI workflows. I can focus on building the product instead of spending hours setting up backend infrastructure.

The team also keeps shipping new features, which is always great to see with an LTD.

My only suggestion would be to keep improving the onboarding as the platform gets more powerful.

Overall, easily one of my favorite AppSumo purchases. 🚀

Until Sept 24, 2026, ANY registered NoCodeBackend user — free or paid — who knew your email address could view YOUR databases and copy YOUR master API keys. I reported it privately; they silently patched it, then replied "We don't see any issues."

Plain language, for non-technical buyers: type someone's email into one page of the app, and it handed back that person's master keys — live API keys with full read/write authority, plus internal database credentials. No hacking, no password guessing. Your data was only as safe as your email address being unknown. The one check that stops this — "is the asker actually the owner?" — is a single line of code. It was missing — and with no monitoring, a less honest visitor could have pulled other customers' data for months without the vendor ever knowing. I reported it instead. Whether anyone exploited it first is something no one — including the company — can rule out.

The other half of this review is what the vendor did with a free, reproducible security report from a customer. I paid for the top tier nine months ago but, beyond an initial test setup, had barely used it — Sept 24 was my first real attempt to build with it, and the problems surfaced that same day. Until then I had no complaints; this would have been 4 stars. Here is the sequence.

What I found (Sept 24, 2026)

Three findings, reproduced against my own paid account only:

Broken access control (IDOR). GET /api/databases/list scoped its response to an email query parameter and never checked that the caller's token belonged to that email. Any registered account plus any customer's email returned that customer's full database list — including live sk_live keys with full CRUD authority and internal DB credentials.

Database port open to the entire internet. The production DB host (129.146.189.183) had port 3306 (MariaDB 10.6.7) world-reachable. Shodan had indexed it months earlier. Every customer's data lives on this single shared instance — one set of leaked credentials exposes all tenants.

No rate limiting on authenticated endpoints, and everything runs on a single VM with no replica — one host failure takes down every customer at once.

What I did — with the exact timeline

On Sept 25 I sent a private disclosure report — endpoints, reproduction steps, evidence, fixes. Timeline (UTC):

09:36 — I send the full disclosure report to support.

09:45 (+9 min) — Simar replies: "Let our security team go over it and we will respond you back soon."

11:07 — With no reply on the substance since the 9-minute acknowledgment, I request a refund for my top-tier purchase, citing the security state.

11:10 (+3 min) — Simar replies: "We don't see a any issues for the critical vulnerabilities you reported. The architecture works as expected. Secondly, unfortunately no refund can be granted after nearly 9 months of usage. Kindly go through our refund policy."

The security team was supposedly "going over it" — yet "no issues" landed 3 minutes after my refund request, too fast for any investigation, while the fix was already live: acknowledge, patch, deny, refuse refund.

What actually happened to the "non-existent" issues

My Sept 25 re-tests found:

/api/databases/list now returns 403 Forbidden — server-side ownership validation added. The exact fix my report recommended.

Port 3306 no longer accepts connections (timeout), while 443 on the same host responds normally — a selective firewall rule, not an outage.

Real enough to patch immediately; not real enough to acknowledge.

Anyone can verify this independently

Shodan's free InternetDB still holds the record for 129.146.189.183 — port 3306 open, MariaDB 10.6.7 — captured by a third party before my report. Check it yourself at internetdb.shodan.io. If port 3306 "worked as expected," there would have been nothing to close.

Why this matters more than the bugs

Silently shipping a fix is normal, and patching fast is competent engineering. But replying "we don't see any issues" in writing, minutes after acting on my report, is a choice: fix the code, deny the problem, keep the review score.

And the quiet part: I chose to report — someone who chose to steal needed only a list of email addresses, and the company would never have known. That uncertainty is the real product of this architecture, and their answer to it was "works as expected."

If they had replied "thank you, you're right, we've patched it," this would have been a 5-star review. They chose the other path.

Buyer's note: the product idea is good and the AI database setup genuinely saves time. If you keep anything sensitive here, know what was behind it: a missing one-line ownership check, a database port open to the whole internet (Shodan-verified), a single shared server with no replica — and a support reply that calls all of that "as expected."

Evidence preserved: before/after captures, timestamps, disclosure correspondence. Facts limited to my account and third-party (Shodan) records.

Hi Sumo-lings! 👋

A useful product is great. A useful product backed by a team that keeps improving it AND actually listens? That's what gets me excited!

NoCodeBackend brings those things together, like really 🙂

The biggest win? Not having to reinvent the backend every time you want to build something..

Create your database and get automatically generated REST APIs (yes, this is free for every DB, unlimited times) and documentation instead of setting all of that up manually. For MVPs, internal tools, and app projects, that is a seriously compelling starting point. Less repetitive setup, more attention on what your application should actually do 😎

And don't let the "no-code" name fool you into thinking this SaaS is only for beginners. Built-in authentication, row-level security, and relational data capabilities make it much more interesting than a simple DB with an API attached. Making development simpler doesn't have to mean making the possibilities smaller..

The MCP integration is another standout, they even improved it several times, now they support both SSE and Streamable HTTP! 🤯

Connecting NoCodeBackend with AI development tools such as Cursor and Claude Code opens up workflows for designing schemas, managing data, and configuring your backend through natural language. That's the kind of practical AI integration I like to see .. not just another text generator bolted onto a dashboard.

But what really deserves recognition is the team behind it.

Riya, Jass, Simar, Justin .. and everyone involved, this is for you: THANK YOU! 🙏

The pace of updates has genuinely impressed me. You listen to Sumo-lings' feedback, keep improving the product, and communicate in a responsive, straightforward, no-nonsense way. Those things matter to me just as much as an impressive feature list. Also thank you for adding the native support for R2! 🙏🙏

The product gives me reasons to be interested. The team gives me reasons to stay excited. I also purchased several add-ons!

One practical recommendation for fellow Sumo-lings: check the database, record, and feature limits of your chosen tier so you pick the right fit for your projects. The offer has different allowances .. and not everything is unlimited across every plan. I suggest grabbing at least 3x Tier 5 LTD licenses here on AppSumo, as this deal is insane! 🚀🚀

My verdict? An enthusiastic 500/5 TACOS! 🌮🌮🌮🌮🌮 ... (yeah 500, not only 5, as this deal is like unreal) 😅

Sumo-lings, when you're choosing tools for your next app, don't overlook this one. NoCodeBackend deserves a serious look .. not just because of the features, but because of the people building it. And the people behind this one .. they are just amazing!

Less backend busywork. More building. THAT is this GAME-CHANGER SaaS - NoCodeBackend! 🚀

Thank you and keep shipping! 💎

New Update.

Riya. I'm genuinely sorry my response has been interpreted as an attack on you and your product — it wasn't one. Facts aren't unkind or unfair, and you confirmed the key one yourself: most reviews came from the unlimited campaign. My good faith is on record — Tier 5 bought, 5 stars given. I'll leave it there, with good wishes.

Update.

To be clear: I have not repeatedly focused on the older unlimited deal — I have made observations about the new one, and I do appreciate a lifetime offer. But AppSumo is an exchange: you receive honest feedback and a cash influx; we receive a lifetime deal. I have provided my side — detailed feedback, suggestions you have partially implemented, and a top-tier purchase.

I understand the sustainability explanation very well: unlimited database growth forever for a single payment was never realistic — reflected in your return to AppSumo with nothing unlimited.

My concern was never that you had to provide unlimited infrastructure forever. I wanted to see a reasonable path for an application that grows beyond its current capacity.

You asked me to re-check the reviews — so I did, in case I owed you an apology. What the full set of reviews and questions actually shows:

• 96 of 132 reviews (73%) — 87 of them 5-star — date from the unlimited campaign (Sept 2024 – Mar 2025).
• 92% of all 5-stars predate the current offer; only around 11 reviews exist under current terms, several being updated older reviews — including mine.
• Nine reviews mention unlimited — every one 5-star. One names "the lack of limits on the number of records in the database" as a "standout feature that drew me in"; another calls the deal "an absolute no-brainer," citing unlimited tables and API calls.
• Your 4.78 average was earned under unlimited terms — the model you've called unsustainable built the social proof this deal benefits from. Your own reply confirms the previous campaign was unlimited.
• Around 25% of your 359 buyer questions are about records and limits — the biggest single topic in your Q&A.

What I actually asked for was not unlimited — it was 500K records per database as standard: a fair compromise on a return deal that remains, even with recent improvements, less generous than the original. I believed it would win you more customers should you return — which is why I suggested it, alongside the cheaper scaling add-on you've since introduced.

I share this not to win an argument, but because accurate information is useful to you — particularly for any future campaign. I have only ever offered constructive feedback and suggestions, and I appreciate that you've implemented some of them.

I genuinely believe in the product and the team — otherwise I wouldn't have purchased Tier 5, or upgraded my review from 4 to 5 stars. I wish you every success.

Update.

I’ve increased my rating to 5 stars based on the current offer and the team’s response. This review is for the new Tier 5 deal, not the original unlimited-records deal, which was clearly better value for buyers but likely unsustainable for the company.

The new paid records add-on makes scaling a single database beyond the included 250k records much more affordable. I had hoped Tier 5 would include a 500k baseline as standard, so this does not fully answer my original concern. However, it does address a significant part of the issue and makes scaling an app more practical.

One final thought: I still believe 500k per database would be a fairer baseline, especially given the previous unlimited deal, while keeping paid add-ons for higher usage. Even with the recent improvements, new buyers should compare the current limits carefully against the older reviews, as many of those clearly relate to the unlimited offer.

Even with the add-on now increased to 500k, I still feel a 500k baseline for each database — rather than a 250k included limit with paid expansion — would have made this return to AppSumo considerably more compelling. I hope the team will consider this if they return with a future deal.
....
I appreciate Riya and the team listening and responding, and I understand their focus on building a sustainable business. New buyers should still be clear that the base Tier 5 limit is 250k records per database, with higher capacity available as a paid add-on rather than included.

Tier 5 buyer here. The product has potential, but the current record limits are the main blocker for me. At this tier, 500k+ records, or a reasonably priced records add-on, would make it much easier to justify and scale. As it stands, scaling could become expensive quickly, and I’m not yet sure I’ll keep it beyond the 60-day refund period.

I understand this is a new offer and not the previous unlimited deal, but new buyers should note that many existing 5-star reviews appear to relate to that older offer rather than the current limits. With the refund window approaching, I hope the team can clarify whether higher limits or add-ons are planned.