What you need to know
Fast AI app building creates real exposure when nobody owns the result. Name an owner, review before release, give exceptions a route, and decide whether you govern apps after the fact or generate them inside a governed platform.
Start with the evidence, and who published it
Three dated sources frame the risk. A Retool survey of 307 technology and security leaders (June 2026, vendor survey) found 93% at least somewhat concerned about vibe-coded tools in production and 38% ranking them a top operational risk. ISACA (July 2026) cites a RedAccess analysis of more than 5,000 apps with little or no authentication, nearly 40% exposing sensitive data. Dataiku (May 2026) describes an agent-built Replit application that wiped a customer's production database. None is a measurement of your estate; use them to justify a review, not to size it.
Give each application an owner
Name the team responsible for access, data and changes. Separate experimenting from publishing into a live business process.
Make review part of delivery
Check access control, sensitive data, integration permissions and recoverability before release. Record what was approved.
Build a safe route for exceptions
Provide a simple way to request a new tool or a new use case. Unclear rules encourage work to move out of sight.
Keep the evidence useful
Collect the logs, approvals and recovery tests needed to explain what happened. Revisit controls when the application or vendor changes.
Choose a governance layer or governed generation
There are two broad routes. One keeps building in AI coding tools such as Lovable, Replit, Cursor or Claude Code and adds a governance layer over the result. Retool, whose survey is cited above, is an example of a vendor in that space; confirm which build tools it covers today. The other generates applications inside a governed platform, so access control, review and audit exist from the first build. A layer keeps tool choice open but governs after the fact; governed generation narrows the tools but starts governed. Test either route with one real application and ask what happens to the code and data if you leave.
Your vendor checklist
- Name an owner for every AI-built application.
- Check authentication, sensitive data and permissions before release.
- Keep a simple route for new tool requests.
- Keep logs, approvals and recovery tests as evidence.
- Decide whether you govern apps afterwards or generate them inside a governed platform.
More field guides
Dated sources
- Retool survey of 307 technology and security leaders (Business Wire). June 2026. Published 17 June 2026. Vendor survey: Retool sells governance tooling, so read the results as one interested party's data. Reported figures: 93% at least somewhat concerned about vibe-coded tools in production; 38% rank them a top operational risk.
- ISACA, Vibe Coding and the AI Security Governance Gap. July 2026. Published 29 July 2026. Cites a RedAccess analysis of apps built on platforms including Lovable, Replit, Base44 and Netlify: more than 5,000 with little or no security controls or authentication, nearly 40% exposing sensitive information.
- Dataiku, Enterprise vibe coding has an AI governance problem. May 2026. Published 7 May 2026. Dataiku is a data and AI platform vendor. Describes a Replit-built application, constructed by an AI coding agent, that wiped a customer's production database.