A citizen developer is someone outside the engineering team, such as an analyst, recruiter or finance lead, who builds apps and automations with low-code, no-code or AI-assisted tools. Security cares because these apps connect to company systems with real credentials, yet they often skip the review that normal code receives.
Definitions worth keeping straight
- Low-code: a platform where you assemble logic visually and add code only where needed.
- No-code: the same idea with no code at all, usually forms, flows and connectors.
- Citizen development: the practice of business users building with these tools.
- Connector: a prebuilt link from the platform to another service, such as a CRM, a drive or a database.
- Flow or workflow: a chain of triggers and actions, sometimes calling other flows.
OWASP's project notes that the term citizen developer has been around since 2009 and that AI-assisted tools now let people across all backgrounds build sophisticated software at scale.
Why this is a security topic and not just an IT topic
An app built in an afternoon can still read a customer table, send email as an executive or write to a finance system. Three properties make it risky.
- It runs with access. A connection stores a credential, often the builder's own.
- It is easy to copy and share. A useful flow spreads to teams that never reviewed it.
- It is invisible by default. Unless a platform admin exports the list, security never sees it.
None of this means the builders are careless. They are solving real problems with the options in front of them, and the options are often insecure by default.
What good looks like
The aim is not to turn analysts into engineers. It is to make the safe path the easy path.
| Need | Light-touch control |
|---|---|
| Know what exists | Registry of apps with owner and purpose |
| Limit blast radius | Dedicated service identities, narrow scopes |
| Protect data | Approved connector list, review for sensitive data |
| Reuse safely | A small vetted library of templates and components |
| Stay current | Review date and an owner who still works here |
What to ask a citizen developer in a first conversation
- What problem does this app solve, and who uses it?
- Whose login does it run as?
- What data does it read, and where does that data go next?
- If you left tomorrow, who would own it?
These four questions surface most of the issues in the OWASP list without any jargon.
A note on tone
Amnesty works better than enforcement for the first pass. If people fear that a registry means a shutdown, they hide the apps. Offer help and a fast path to approval, and the registry fills itself.
Where Safeguard fits
Safeguard's asset discovery and dependency scanning help engineering teams see the repos, services and packages they run. Citizen-built apps inside a platform still need that platform's own admin tools for inventory. You can try a free scan at https://gold.safeguard.sh/scan.
Quick check
Is a citizen developer the same as shadow IT?
Not always. Many citizen developers work on approved platforms. Shadow IT starts when the app or platform is outside IT's knowledge.
Should citizen developers get code review?
Scale it to risk. Personal productivity flows need little. Apps touching customer or financial data should get a security review before launch.
Sources
Last reviewed: 19 October 2026.
