Before a low-code app goes to production, confirm it has a named owner, a service identity, a documented data flow, restricted sharing, validated input, useful logging and a way to switch it off. Run the checklist for team and sensitive apps. A short gate catches most of the issues OWASP describes.
Why a gate
OWASP recommends a pre-deployment security auditing and validation step to review generated or modified code before release, along with mandatory version control and secure deployment. For apps that handle sensitive data, it also recommends involving the security team in review.
The checklist
Ownership and lifecycle
- Owner and backup owner named in the registry.
- Purpose, audience and tier recorded.
- Review date set.
Identity and access
- Runs as a service identity, not a personal login.
- Each connection uses the narrowest scope.
- Connections are not shared with other apps.
- Admin and maker roles limited to named people.
Data
- Data flow mapped, including sub-flows and destinations.
- Only needed fields move between systems.
- Destinations are on the approved list.
Configuration
- Sharing audience reviewed.
- No anonymous endpoint returns private data.
- Secrets in the protected store, none in fields or scripts.
- Certificate validation on, HTTPS only.
Input handling
- Fields validated by type and length.
- Queries parameterized.
- Platform expression characters tested as plain text.
Components
- Templates and sub-flows come from the approved library or were reviewed.
- Custom code blocks read by a second person.
- Packages in any scripts are real, current and listed.
Logging and recovery
- Actions logged with user and record identifiers.
- Debug logging off, no secrets in logs.
- A named person can disable the app within minutes.
How to run it without slowing people down
| Tier | Gate |
|---|---|
| Personal | None beyond registration |
| Team | Builder completes the list, reviewer spot checks |
| Sensitive | Reviewer completes the list with the builder, security signs off |
Promise a response time, such as two working days, and publish it. A gate with no deadline becomes a reason to work around it.
Keep a record
Store the completed checklist with the registry entry. It documents the decision and helps the next reviewer when the app changes. Re-run the checklist when a trigger fires: a new connector, a wider audience, a new data source or an owner change.
For the tiering model, see how to tier low-code apps by risk.
Where Safeguard fits
For code that accompanies these apps, Safeguard's policy gates can block a change when rules fail, and dependency scanning covers packages. You can try the free scan at https://gold.safeguard.sh/scan.
Quick check
Does every app need the full checklist?
No. Apply it to team and sensitive tiers. Personal flows only need registration.
Who signs off a sensitive app?
A security reviewer, with the owner confirming the details.
Sources
Last reviewed: 19 October 2026.
