The defaults most likely to expose data in low-code apps are public endpoints without authentication, broad sharing, anonymous access, and secrets stored in plain configuration. Review those settings on every platform at tenant level, then check each app before launch.
Why defaults matter
OWASP's Security Misconfiguration risk (CD-SEC-07) says platforms balance security against support for many use cases, and that many settings are made at the app level rather than the tenant level. That means business users, not administrators, can choose insecure options. AI-generated code adds to the problem because an assistant aims for working code and will not add controls nobody asked for.
OWASP's example: a builder creates a public web form, and the platform generates a REST endpoint to process submissions. The default for that endpoint is publicly accessible without authentication. An attacker finds it, sends requests and receives sensitive customer data.
The checklist
| Area | Question | Target |
|---|---|---|
| Endpoints | Does any generated API allow anonymous calls? | Auth required unless the purpose is public |
| Sharing | Who can open or copy the app? | Named groups, not everyone |
| Data stores | Are tables or files readable by guests? | No anonymous read |
| Secrets | Are keys held in plain text fields or exports? | Use the platform's secret store |
| Connections | Does the app use a personal login? | Service identity |
| Environments | Is test data separate from production? | Yes |
| Debug mode | Is verbose logging or debug on in production? | Off |
| Tenant settings | Can app makers change security options? | Locked by admins where possible |
How to review in practice
- Start at tenant level. List which security settings makers can override and lock down the ones that matter most.
- For each sensitive app, open the sharing page and read the actual audience.
- Find every generated or custom endpoint and test it without signing in.
- Search app exports for strings that look like keys or tokens.
- Check that the app lists an owner and a review date.
Fix patterns
- Make the safe setting the default and hard to disable, which is the first action OWASP lists under Blind Trust.
- Provide a template with authentication, logging and sharing set correctly, so people start from a good state.
- Add a pre-launch step for apps that handle sensitive data.
When AI writes the app
Ask assistants for the controls explicitly: authentication on every route, input validation, no hard-coded keys. Then read the output. The assistant will do what you asked and little more.
Where Safeguard fits
For application code and APIs, Safeguard offers dependency scanning, reachability analysis and policy gates that block risky changes, and the free scan at https://gold.safeguard.sh/scan shows how a repository looks today. Platform sharing settings are changed in the platform itself.
Quick check
Who should set tenant security options?
Administrators. Where a setting must be left to makers, publish a safe template and review high-risk apps.
How do I test an endpoint quickly?
Call it from a browser or tool without any login. If it returns data, authentication is missing.
Sources
Last reviewed: 19 October 2026.
