Find forgotten prototypes by looking in five places: source repositories, cloud and hosting accounts, DNS records, billing statements and the list of active API keys. Match what you find to an owner, then decide to promote, retire or investigate each one.
Why the sweep is worth doing
AI coding tools lower the cost of building a working app to an afternoon. That is the benefit, and also the reason prototypes multiply faster than anyone tracks them. A forgotten app may hold live credentials, expose an endpoint, or depend on a package that has since been found vulnerable. You cannot patch what you do not know exists.
The five places to look
| Place | What to look for | How to check |
|---|---|---|
| Source repositories | Recently created repos with few contributors, names like demo, test, poc | List repos by creation date and activity |
| Cloud and hosting | Projects, functions and services outside the normal account structure | Account inventory, including personal-card accounts reported by staff |
| DNS | Subdomains pointing at hosting you do not recognise | Export zone records and review each entry |
| Billing | Small recurring charges for hosting, databases and AI APIs | Review card and invoice lines |
| Keys and tokens | API keys created for tests that are still active | Provider dashboards, sorted by last used |
A three-step triage
Step 1: Record. Put every find in one list with its location, apparent owner and what it seems to do. Do not delete anything yet.
Step 2: Ask. Send each suspected owner a short message: is this yours, is it still needed, and what data does it hold? Most people reply quickly, and many are glad to be told to turn it off.
Step 3: Decide. Each item gets one outcome.
- Retire: take it down, revoke its keys, delete its data.
- Promote: move it through your normal review.
- Investigate: if no owner claims it and it holds data, treat it as a possible incident and involve your security lead.
Make the next sweep easier
Ask people to register a prototype when they start one. A shared template repository with an owner and expiry field makes discovery a query instead of a hunt. A monthly review of new repositories and new keys catches drift early.
Add a rule that anything unregistered after thirty days is flagged. It sounds strict, but it is simply how you keep a list useful.
Include the tools that act on their own
Prototypes are not only web apps. Teams also wire up AI agents and tool servers with credentials. Include them in the sweep: which agents exist, what identity they use, and which tools they can call.
Where Safeguard fits
Safeguard's asset discovery and agent identity capabilities are designed to give you an inventory of what is running and what it can reach, and dependency scanning shows which of those assets carry known vulnerabilities. You can start with a free scan at gold.safeguard.sh/scan.
Quick check
Should I delete forgotten prototypes right away?
Record them first and ask the owner. Revoke their keys immediately if there is any doubt, since that is reversible and safe, then delete once confirmed.
How often should we sweep?
A monthly review of new repositories and keys is light enough to sustain. A fuller sweep each quarter catches what slips through.
Sources
Last reviewed: 19 October 2026.
