To inventory low-code and no-code apps, list every platform in use, export apps and connections from each platform's admin tools, assign a named owner, tag data sensitivity and set a review date. Treat the result as a living register, not a one-time spreadsheet.
Why inventory comes first
OWASP lists Asset Management Failures as one of its ten citizen development risks. Ease of creation, combined with the volume of custom configuration, leads to ungoverned, unpatched and orphaned apps. OWASP's own prevention advice starts with a centralized governance function, enforced ownership and a comprehensive inventory of applications, components and users.
Step 1: list the platforms
Platforms hide in unexpected places. Check:
- Your identity provider's app list.
- Expense and card spend on automation and form tools.
- Your core business suites, which often include a flow builder.
- A short survey to each department head.
Step 2: export what each platform can tell you
Most platforms let an admin list apps, flows and connections. Record the raw export before you clean anything. Note what a platform cannot report, because that gap is itself a finding.
Step 3: use a minimum record
| Field | Why it matters |
|---|---|
| App name and platform | Finding it again |
| Owner and backup owner | Someone to ask and someone to act |
| Purpose in one line | Judging whether it is still needed |
| Identity it runs as | Spotting personal logins |
| Connectors and scopes | Sizing the blast radius |
| Data classes touched | Prioritizing review |
| Users or audience | Telling a personal flow from a shared one |
| Last review date | Stopping rot |
Step 4: tag and tier
Mark each app personal, team or sensitive using the data it touches and the actions it can take. Review sensitive apps first. A short three-tier model is easier to keep alive than a long scoring sheet.
Step 5: set the review rhythm
Pick a date for each app. Quarterly for sensitive, yearly for team, and on demand for personal. When an owner leaves, the app is reassigned or switched off, never left running.
Common mistakes
- Building the inventory once and never updating it.
- Letting owners be a team alias nobody monitors.
- Counting apps but not connections, which is where the risk sits.
- Skipping the shared apps because they feel official.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a dependency list becomes useful once each entry has context, the same idea as an owner on every app.
Where Safeguard fits
Safeguard's asset discovery and SBOM generation cover repositories, services and packages your engineers run, and the free scan at https://gold.safeguard.sh/scan lets you see a dependency inventory quickly. The platform-hosted apps themselves still come from each platform's admin export.
Quick check
How many fields should an inventory have?
Eight or fewer. A record people keep current beats a detailed one they abandon.
Who should own the inventory?
A named governance owner, often in security or IT, with the app owners responsible for their own rows.
Sources
Last reviewed: 19 October 2026.
