In today's rapidly evolving tech landscape, a new phenomenon has emerged that is challenging traditional security practices: vibe-coded apps. These apps, created with the help of AI agents, are the latest form of shadow IT, and they are revolutionizing the way internal tools are developed and deployed.
The Rise of Vibe-Coded Apps
Vibe-coded apps represent a significant shift from the classic shadow IT, which often involved unauthorized SaaS tools. Unlike their predecessors, these apps don't leave traces in OAuth logs; instead, they manifest as infrastructure within your cloud account. The speed and ease with which an engineer can create and deploy these apps using AI agents have eliminated the friction and inefficiencies of traditional development processes.
The Challenge: Security vs. Efficiency
The problem with vibe-coded apps is not malicious intent but good intentions gone awry. Engineers, empowered by AI, can quickly build and deploy internal tools without realizing the potential security risks. This results in code sprawl, where infrastructure with IAM roles and access to sensitive data is created without proper security measures in place.
Differentiating from SaaS Sprawl
Unlike SaaS sprawl, where unauthorized tools existed outside the infrastructure and could be detected and cut off, code sprawl is more insidious. Agent-built internal tooling lives within the infrastructure, making it harder to detect and control. The code doesn't announce itself as ungoverned; it blends in with legitimate tools, making it challenging to identify and manage.
Building a Secure Baseline
The goal is not to slow engineers down but to make the safe path the easiest. At Webflow, we're working towards a two-layered baseline: platform controls and process controls.
Platform controls, configured at the org or account level, make it harder to accidentally do the wrong thing. This includes IAM least-privilege guardrails, secrets manager enforcement, and VPN-gated deployment targets. Process controls, on the other hand, ensure that human review with security context happens before anything ships. This involves automated baseline checks and security-informed code reviews, with escalations to formal Security reviews for higher-risk tooling.
Detection and Prevention
The baseline is preventive, but detection is crucial for catching what slips through. CSPM tools like Wiz can help find misconfigurations, but they only detect what's already deployed. Behavioral signals in cloud telemetry can provide early warnings, such as IAM role creation outside normal pipelines or new public-facing resources without change records.
Making the Baseline Useful
A codified baseline that's easily accessible within the tools engineers use is essential. AI-native tooling, like Claude skills, can review architecture descriptions and infrastructure against specific security baselines, providing engineers with actionable feedback. This approach ensures that the baseline is used when needed and that the review process is more effective.
The Way Forward
Vibe-coded internal tools are here to stay, and it's crucial to adapt security practices accordingly. Building a clear baseline, enforcing it with the right tooling, and ensuring engineers understand what they're reviewing are key steps. This approach distributes responsibility while maintaining a clear escalation path, allowing a small, well-structured security team to tackle the problem effectively.
In conclusion, the rise of vibe-coded apps presents a unique challenge, but with the right strategies, organizations can strike a balance between innovation and security.
