Not by default. A marketplace template or shared component is third-party code you have not reviewed, and one flaw can be copied into many apps. Vet them like any dependency: check the source, read nested logic and custom code blocks, test in a sandbox, and keep a small approved internal library.
The risk in OWASP's words
OWASP covers this under Blind Trust (CD-SEC-01) and Vulnerable and Untrusted Components (CD-SEC-06). Citizen developers often treat prebuilt components as inherently secure. Three biases help that along: automation bias, the availability heuristic (the easy option gets picked) and anchoring on the first template offered.
OWASP's scenario: an attacker uploads a benign-looking login template to a platform marketplace with a hidden script in a nested component or custom code block. A builder imports it. When users sign in, the script quietly captures credentials and sends them to the attacker, while the login works normally.
For components, OWASP notes that an insecure sub-workflow uploaded to a marketplace can be downloaded and integrated by others, replicating one flaw across the organization. That is a supply chain problem inside a no-code tool.
A vetting checklist
| Check | What to look for |
|---|---|
| Source | Who published it, how long, any history of updates |
| Nested logic | Sub-flows, custom code blocks, scripts, HTTP calls |
| Outbound calls | Any URL not belonging to a service you recognize |
| Permissions | Connectors and scopes it asks for |
| Inputs and outputs | Documented, validated, no extra data passed on |
| Sandbox run | Behavior in a test tenant with fake data |
Steps before import
- Import into a sandbox tenant, never production.
- Open every layer, including subcomponents, and read custom code.
- Run it with dummy data and watch network calls.
- Strip connectors it does not need.
- Record the source and version in your inventory.
- Approve it for a defined data class, not for everything.
Build an internal library
OWASP recommends standardized, vetted component libraries and secure subcomponents for common functions. A handful of approved building blocks, such as a login pattern, a file upload step and a logging step, serves most needs and removes the temptation to hunt a marketplace.
AI suggestions count too
OWASP also warns that AI assistants may reuse a flawed code block across an app, or suggest packages that do not exist or are outdated. If anyone builds with AI help, apply the same vetting to what the assistant proposes, and check that every package is real and current.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each component gets listed with its version, the same record you want for each approved template.
Where Safeguard fits
When template or component code lives in a repository, Safeguard's dependency scanning and SBOM generation list the packages it uses. Try a free scan at https://gold.safeguard.sh/scan. Hidden logic inside a closed platform still needs a manual review.
Quick check
Does a platform review make marketplace items safe?
Do not assume so. Treat marketplace items as unreviewed until you have checked them yourself.
What is the cheapest control?
Require a sandbox import and a read of custom code blocks before anything reaches production.
Sources
Last reviewed: 19 October 2026.
