Securing Citizen Developers: A New Opportunity to Build Safe Applications

### Overview In this talk presented at VulnCon, Kayla Underoffer, Lead Security Engineer in the CTO office at Zenity, explores the rapid rise of citizen developers and the new security challenges and opportunities they bring. Underoffer begins by examining historical lessons learned from "shift left" initiatives in traditional software engineering—where mismatched expectations, alert fatigue, and security acting as a delivery blocker hindered progress. She argues that low-code/no-code platforms and AI agents represent a "new hope" to establish security practices effectively from the outset, provided security teams learn to collaborate with business makers, leverage native platform capabilities, and apply automated guardrails.

### Key Topics - **Lessons from Traditional Shift Left:** Shift-left approaches often struggled due to misaligned expectations between engineering and security, overwhelming volumes of vulnerabilities and false positives, and small security teams acting as bottlenecks. - **The Rise of Citizen Developers:** Business users in domains such as finance, HR, and marketing are building applications, complex workflows, and autonomous AI agents using enterprise low-code/no-code platforms. According to Zenity's 2024 report, organizations averaged over 79,000 such applications, with an average 39.1% year-over-year growth rate. - **The Citizen Development Lifecycle:** Unlike standard engineering processes, the citizen development lifecycle is typically owned entirely by the business, focusing purely on rapid creation without formal software development life cycles, iteration, or security/IT involvement. - **Build-Time vs. Runtime Risks:** Risks are split between build-time design choices (e.g., misconfigured connections) and runtime agent actions (e.g., autonomous triggers, prompt injection, and data exfiltration).

### Technical Details Underoffer details how configuration choices at build time directly dictate an application's or agent's attack surface in runtime: - **Top Build-Time Risks:** Zenity's 2024 report highlights authorization misuse, authentication failures, and improper data/secrets handling as the primary risks. - **Authorization Misuse:** Illustrated via a credit approval agent where an action connector was configured to use the creator's personal credentials (Chris interacting with Salesforce). When shared across an organization, all users effectively act under Chris's permissions. - **Authentication Failures:** Illustrated with an agent ("hackerbot v2") connected to internal SharePoint data that was left completely unauthenticated, making internal critical data publicly accessible. - **Secrets Handling:** Citizen developers frequently hard-code plaintext credentials and API keys into workflows due to a lack of security background. - **Runtime & AI Agent Risks:** Illustrated through an autonomous email support agent triggered by incoming messages where the maker failed to filter the "From" address field, exposing the agent to runtime manipulation, sensitive data exfiltration, or indirect prompt injection.

### Takeaways & Remediation Strategy Underoffer outlines a four-part framework tailored to low-code/no-code ecosystems: 1. **Visibility & Inventory:** Overcome "shadow environments" by leveraging enterprise platform features and third-party tools to inventory who is building what, prioritizing environments holding critical business data. 2. **Risk Assessment:** Evaluate the "how" of application design and rely heavily on automated scanning, as manual penetration testing is still underdeveloped in these ecosystems. 3. **Remediation:** Take advantage of platform controls for "silent remediation"—such as programmatically stripping sensitive data from logs or changing authentication and guest access settings automatically at the environmental level, supplemented by automated outreach for manual fixes. 4. **Prevention & Culture:** Enforce environmental-level guardrails to remove insecure options from makers, meet business users where they work (rather than expecting them in Jira/ServiceNow), and pair automated fixes with clear educational feedback. Underoffer highlights a referenced BlueHat talk featuring Microsoft and Zenity, where an under-five-person team reduced organizational low-code/no-code risk by 90% in four months.