No-code and low-code platforms let people build apps and workflows with little or no traditional coding. RPA drives existing applications by imitating a user. All three put powerful automation in the hands of non-engineers, but the main exposure differs: apps leak data and permissions, while bots hold privileged logins.
Plain definitions
No-code: builders assemble apps from visual blocks without writing code. Low-code: similar, with the option to add code where blocks run out. RPA: software that follows a predefined workflow to operate other applications through their screens, as Wikipedia's overview puts it.
The OWASP Citizen Development Top 10 uses the umbrella term citizen development for software built by business users with low-code, no-code, AI assisted coding and AI agents. Its first risk is Blind Trust.
Comparison
| Question | No-code | Low-code | RPA |
|---|---|---|---|
| What gets built | Apps, forms, workflows | Apps with custom logic | Bots that operate other apps |
| Who builds it | Business users | Business users and developers | Business analysts and developers |
| Where does it run | The platform's cloud | The platform | A server or desktop |
| Main identity risk | App acts as its creator, or shares one connection | Same, plus custom code credentials | Bot logins with broad access |
| Main data risk | Overshared apps and exposed links | Same, plus injection in custom code | Data copied between systems and into logs |
| Main code risk | Third party connectors and templates | Custom code and libraries | Custom scripts and libraries |
| Typical blind spot | Apps nobody inventoried | Same | Bots nobody retired |
What they share
Every one of the three runs with some identity, connects to some data, and can be built without going through the usual engineering review. So the shared controls are the same:
- An inventory with a named owner for every app or bot.
- Dedicated accounts and connections, not personal logins.
- Secrets in a managed store.
- Minimum permissions.
- Logging that ties actions to an owner.
- Review before anything touches sensitive data, and a plan to retire what is no longer used.
The OWASP list reflects this overlap: account impersonation, authorization misuse, data leakage, injection, asset management failures and logging failures all appear for apps, and the same ideas map to bots.
Where they differ
No-code and low-code risk lives in sharing and connectors: who can see the app, which connectors it uses and whether templates were vetted. Our posts on approved connector lists and marketplace templates go deeper.
RPA risk lives in the bot account and the change history: what it can do on every system it logs into, and who may edit it.
How to pick controls first
If you have limited time, start with the one inventory that covers all three, then add the controls above in order. One shared register beats three separate ones, because the same person often builds all three types.
Where Safeguard fits
Safeguard's asset discovery can help find services and tools across your environment, and its SBOM and dependency scanning covers custom code and libraries that low-code or RPA teams ship.
Quick check
Is RPA a kind of low-code?
Some products blend both, but the risks differ. RPA centres on bot logins, low-code on app sharing and connectors.
Which one is riskiest?
None by default. Risk depends on the data and systems each one can reach, and on whether anyone owns it.
Sources
Last reviewed: 19 October 2026.
