A one-page citizen developer training should cover eight plain rules: use approved connectors, never a personal login for shared apps, keep secrets out of fields, send only needed data, validate input, check templates, turn off debug logs and register the app with an owner. Add when to ask security for help.
Why short and specific
OWASP recommends structured training resources and reference guides for citizen developers on common vulnerabilities and secure practices, with just-in-time guidance in the development environment. Long courses are skipped. A single page that people can read in five minutes and find again inside the tool is more likely to be used.
The eight rules
- Use approved connectors. If you need another, ask. It usually takes a day.
- Do not use your own login in an app others use. Ask for a service identity.
- Keep secrets out of text fields, scripts and shared files. Use the secret store.
- Move only the fields you need. Extra data is extra risk.
- Treat anything a user types as untrusted. Limit type and length.
- Check templates and components before importing. Try them in the sandbox first.
- Turn off debug logging before launch, and never log passwords or full records.
- Register your app, name an owner and a backup, and set a review date.
Four questions to ask before you share an app
- Whose access does it run on?
- What data does it touch, and where does that data go?
- Who can open or copy it?
- If I leave, who takes it over?
When to ask for help
| Situation | Ask security |
|---|---|
| App touches customer, financial or employee data | Yes, before launch |
| App sends messages outside the company | Yes |
| App writes to a system of record | Yes |
| Platform asks for full access to a service | Yes, first |
| App only handles your own notes and files | Register and carry on |
Using AI assistants
Add three lines: say what security controls you want in the prompt, read what comes back, and never install a package you cannot find in the official registry. OWASP notes assistants aim for working code and will not add security you did not ask for.
Delivery tips
- Put the page where makers will meet it, such as the platform's welcome screen or the registration form.
- Pair it with a ten minute walkthrough for new makers.
- Share one real story a quarter, with the details removed, of a problem the registry caught.
- Ask for feedback and fix the page.
Measuring whether it works
Track simple numbers: how many apps are registered, how many use service identities, how many connections are on the approved list and how long reviews take. Improve the process where those numbers stall.
Where Safeguard fits
Safeguard's free scan at https://gold.safeguard.sh/scan lets engineers and advanced makers see dependency risk in a repository in minutes, a useful step to add when someone moves from a flow to a script.
Quick check
How long should the training take?
Five minutes to read, ten for a walkthrough. Anything longer tends to be skipped.
Should training be mandatory?
Make it a condition of getting maker rights on shared or production environments.
Sources
Last reviewed: 19 October 2026.
