How can a Citizen Developer ensure app security without a coding background?

All answers to this question.

Security in the Citizen Development world is a shared responsibility. While the platform provider (like Microsoft or Salesforce) secures the infrastructure, you are responsible for the logic. First, always follow the principle of "Least Privilege"—only give users access to the specific data they need to do their jobs. Second, never hardcode sensitive information like API keys; use the platform’s built-in environment variables. Most importantly, work with your IT department to set up a "Sandboxed Environment." This allows you to build and test your app in a safe space where a mistake won't impact live company data or violate GDPR/CCPA compliance standards.

   Answered 2024-04-22 by Deborah Higgins

Does your company currently have a formal "Center of Excellence" (CoE) for low-code development that provides pre-approved templates and data connectors for non-technical staff?

   Answered 2024-05-05 by Steven Thompson

• Steven, we don't have a CoE yet, but I've been pushing for one. My goal is to show IT that we can be "partners in innovation" rather than a risk. I’ve started documenting my data flows using simple diagrams to show them exactly where information is being stored. By being transparent about my "Shadow IT" projects, I’m finding that the security team is much more willing to give me access to the official SQL databases because they can see I'm following their encryption requirements.

     Commented 2024-05-15 by Heather Miller

Always use Multi-Factor Authentication (MFA) for your app logins. It is the single most effective way to prevent unauthorized access to the tools you build on these platforms.

   Answered 2024-06-10 by Brian Foster

• Great point, Brian. MFA is a non-negotiable standard today. If the platform you're using doesn't support SSO or MFA, it’s probably not enterprise-ready.

     Commented 2024-06-18 by Deborah Higgins