Unmasking the Dark Side of Low-Code/No-Code Applications

December 18, 2023The Hacker NewsTechnology Security / Applications

Applications Without Code

Low-code/no-code (LCNC) and robotic process automation (RPA) have gained huge popularity, but how safe are they? Is your security team paying enough attention in an era of rapid digital transformation, where business users are empowered to develop applications rapidly using platforms such as Microsoft PowerApps, UiPath, ServiceNow , Mendix, and OutSystems?

The simple truth is often swept under the rug. While low-code/no-code (LCNC) apps and robotic process automation (RPA) are driving efficiency and agility, their security dark side needs to be explored. LCNC application security has emerged as a new frontier, and even seasoned security practitioners and security teams are grappling with the dynamic nature and volume of citizen-developed applications. The rapid pace of LCNC development presents a unique challenge for security professionals, highlighting the need for dedicated efforts and solutions to effectively address the security nuances of low-code developments. environment.

Digital Transformation: Trading Security?

One reason that security finds itself in the back seat is a common concern that security controls are potential speed bumps in the digital transformation journey. Many citizen developers strive for easy app creation but unknowingly create new risks at the same time.

The truth is that LCNC apps leave many business applications exposed to the same risks and damages as their traditionally developed counterparts. Finally, it requires a closely aligned security solution for LCNC to balance business success, sustainability, and security.

As organizations prioritize LCNC and RPA solutions, it is time to recognize that the current AppSec stack is inadequate for protecting critical assets and data exposed by LCNC apps. Most organizations are left with manual, cumbersome security for LCNC development.

Unlocking Uniqueness: Security Challenges in LCNC and RPA Environments

While the security challenges and threat vectors in LCNC and RPA environments may be similar to traditional software development, the devil is in the details. The democratization of software development to a wider audience, the development environment, process, and participants in LCNC and RPA represent a transformative shift. This type of decentralized app creation has three main challenges.

First, citizens and automation developers tend to be more prone to unintentional, logical errors that can result in security vulnerabilities. Second, from a perspective, security teams face a new type of shadow IT, or more precisely, Shadow Engineering. Third, security teams have little or no control over the LCNC app life cycle.

Governance, Compliance, Security: A Triple Threat

The three-headed monster that plagues CISOs, security architects, and security teams — governance, compliance, and security — is especially bad in LCNC and RPA environments. To illustrate, here are some and, of course, non-exhaustive examples:

  • Management challenges can be seen in old versions of applications that hide in production and decommissioned applications, which cause immediate concerns.
  • Compliance breaches, from PII leakage to HIPAA violations, reveal that the regulatory framework for LCNC apps is not as strong as it should be.
  • The old security concerns of unauthorized data access and default passwords persist, challenging the perception that LCNC platforms offer unreliable protection.

Four Crucial Security Steps

In ebook”Low Code/No Code And Rpa: Rewards And Risks“Security researchers at Nokod Security suggest that a four-step process can and should be introduced in LCNC app development.

  1. Finding – Establishing and maintaining comprehensive visibility of all applications and automations is essential for strong security. An accurate, up-to-date inventory is necessary to overcome blind spots and ensure proper security and compliance processes.
  2. monitoring – Comprehensive monitoring includes evaluating third-party components, implementing processes to confirm the absence of malicious code, and preventing accidental data leaks. Effectively preventing the risk of critical data leaks requires a thorough identification and classification of data usage, ensuring that applications and automation systems manage data under their classifications. Management includes active monitoring of developer activity, especially reviewing changes made to the production environment after publication.
  3. Action on Violations – Efficient remediation must involve the citizen developer. Use clear communication in accessible language and with LCNC platform-specific terminology, along with step-by-step remediation guidance. You should bring the necessary compensation controls when dealing with difficult repair scenarios.
  4. Protecting Apps – Use runtime controls to detect malicious behavior within your apps and automation or through apps in your domain.

While the steps outlined above provide a foundation, the reality of a growing attack surface, which is not covered by the current application security stack, forces a re-examination. Manual security processes don’t scale well when organizations churn out multiple LCNC and RPA automation applications every week. The efficiency of a manual approach is limited, especially when companies use multiple LCNC and RPA platforms. It’s time for dedicated security solutions for LCNC application security.

Nokod Security: Pioneering Low-code/no-code App Security

Offering a central security solution, the Nokod Security platform addresses this evolving and complex threat landscape and the uniqueness of LCNC app development.

The Nokod platform provides a centralized security, management, and compliance solution for LCNC applications and RPA automations. By managing cybersecurity and compliance risks, Nokod streamlines security throughout the lifecycle of LCNC applications.

Key features of Nokod’s enterprise-ready platform include:

  • Discover all low-code/no-code applications and automation within your organization
  • The placement of these applications is subject to specific policies
  • Identify security issues and identify vulnerabilities
  • Auto-remediation and empowerment tool for low-code / no-code / RPA developers
  • Enables improved productivity with security teams


In the dynamic landscape of contemporary business technologies, the widespread adoption of low-code/no-code (LCNC) and robotic process automation (RPA) platforms in organizations has ushered in a new era. Despite the influx of innovation, there is a critical security gap. Enterprises need to gain comprehensive insights into whether these advanced applications are compliant, free of vulnerabilities, or harboring malicious activities. This expanding attack surface, which is often not detected by existing application security measures, poses a significant risk.

For more timely information on low-code/no-code app security, follow Nokod Security on LinkedIn.

Did you find this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Leave a comment