Unsecured Low-Code Apps Creating Shadow IT Risks, Exposing Sensitive Data

·1 views

The rapid adoption of low-code/no-code platforms like Replit, Lovable, and Vercel is enabling non-technical users to build and deploy applications without security oversight, creating a growing shadow IT problem. A recent incident highlighted the risk when a customer intake form built on Lovable was deployed directly to a live production database with no authentication or access controls, going undetected until an external audit. Two similar cases were later found, including a survey tool connected to an unencrypted shared repository and a landing page with an exposed API key in client-side code. A 2023 study found 380,000 publicly accessible apps on such platforms, with 22% containing exposed credentials or sensitive data. Experts recommend that organizations deploy external attack surface management tools, enforce security-by-design principles in low-code workflows, and provide mandatory security training for non-technical staff.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Failure in Business: How to Measure and Minimize Its True Cost

A personal essay on DEV Community explores the real price of failure in entrepreneurship, drawing on the author's own experiences and those of close family members. The author proposes a practical formula: the cost of failure equals its financial, time, and mental impacts combined. Key financial drains are broken down into categories including staffing, physical and digital products, legal obligations, and personal sacrifices such as time away from family. The piece argues that modern business culture favors a 'fail, learn, repeat' approach over the lengthy pre-launch studies of older models. Ultimately, the author frames failure not as an endpoint but as a necessary step toward eventual success, urging entrepreneurs to stay aware of its full cost in order to recover and move forward.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

m365-extension-control CLI brings release-intent checks to SPFx estates

A new open-source command-line tool called m365-extension-control has been released to help SharePoint Framework (SPFx) teams verify that on-disk project state matches their declared release intent. The tool uses an estate.json manifest to record ownership, lifecycle status, release channel, and expected version details for each project in an estate. Running commands such as scan, inventory, evidence, and preflight, the CLI compares those declarations against local file facts and reports drift, inconsistencies, and ownership gaps. It outputs deterministic JSON and Markdown evidence with CI-compatible exit codes, but deliberately does not interact with any SharePoint tenant or App Catalog. The project ships with 20 deterministic tests, TypeScript support, and GitHub Actions CI, and is available on GitHub at vystartasv/m365-extension-control.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agentic AI Acts as Middleware, Translating Human Intent into API Calls

A new engineering perspective argues that agentic AI is best understood not as a chatbot but as a middleware abstraction layer sitting between humans and digital systems. Rather than having users manually navigate multiple SaaS applications, agentic AI interprets natural-language intent and converts it into structured, deterministic API calls. The process relies on large language models acting as semantic routers that extract parameters and generate JSON payloads, while traditional backend systems handle actual execution. To deploy such systems safely, engineers must apply guardrails including least-privilege API access and human-in-the-loop approval for destructive or irreversible actions. The approach frames agentic AI as the next major step in software abstraction, following the evolution from punch cards to GUIs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Pixel-Art AI Office Where Agents Actually Write Code and Open PRs

A developer built an open-source tool called 'My Little Office' that uses pixel-art characters to represent real AI coding agents assigned to different software roles such as engineer, QA, and tech lead. Each character is backed by actual AI models — including ChatGPT, Gemini, and Grok — that can receive tasks, modify a real codebase, run tests, and open pull requests autonomously. The project began as a playful dashboard concept but evolved when the creator connected agents to a live repository and watched them independently solve coding problems. The creator found that managing these agents shifted their role from writing code to defining problems clearly, setting boundaries, and verifying outputs. This experience prompted a broader reflection on how software development skills may need to evolve as AI handles more of the actual implementation work.

0 comments Read more at DEV Community