Sure, Let Business Users Build Their Own. What Could Go Wrong?

The talk starts from the observation that people outside IT, such as HR staff, now build much of their own business software with low-code and no-code platforms, often with no prior development experience. The speaker, who helps lead an OWASP project on this area, argues that security teams have little visibility into these apps and few controls over them.

Instead of running through the whole OWASP list, the speaker walks through a few real-world style cases and asks the audience to spot the failures. An HR onboarding form stored its records in a database that anyone in a shared default environment could open, and an automation logged full record contents, exposing sensitive identifiers. A second app copied a worker's corporate mail to a personal account, sidestepping email filtering, and it relied on reused refresh tokens with no consent prompt, which could enable phishing inside an organization. Other issues included injection through data passed between apps and automations, and supply chain weaknesses.

The speaker explains why standard controls break down: apps run under the maker's identity so individual users cannot be told apart, there is no development lifecycle or review gate, and the volume is far larger than traditional development. Suggested responses include plain-language awareness material based on the OWASP Top 10, clear rules on which environments and use cases are acceptable, and using the logs these platforms already produce, with automation to detect and fix problems.