Yesterday, I had an experience that made me stop and rethink how I’m developing my low-code projects.
I was analyzing an app I’ve been building for a client and decided to test that scan tool that @georgecollier made available for free. Honestly? I was shocked by what I found.
These weren’t minor issues. They were security gaps that could compromise real data from real users.
And look… this isn’t about incompetence. The project has a solid team, people who know what they’re doing. But when you’re rushing to deliver features, meet client demands, and make that integration work… the basics can slip through the cracks.
I personally had no idea that certain endpoints were exposed in that way.
@georgecollier’s tool revealed things I would NEVER have seen on my own. And it saved the project from a serious problem.
Let me give a concrete example of what I found:
There was a magic link creation endpoint configured as public. It required authentication, but it completely ignored privacy rules.
In practice? Any logged-in user could take their own authentication token, replace it with another user’s ID, and generate a valid magic link to access someone else’s account.
Yes, it would require technical knowledge. Yes, the attacker would first need to create a legitimate account. But with a simple script generating random IDs, it would only be a matter of time before unauthorized access was achieved.
The solution was simple: add a verification layer using an API key parameter in the first step, or configure privacy rules that validate whether that token has permission to access that specific other user.
But with the pace of an operation that needs to deliver results fast, this kind of thing slips through. And it can’t.
So here’s the warning to the community:
Study privacy rules in depth. Review your API workflows with a critical eye. Test your endpoints by thinking the way a malicious actor would think.
And even if you believe your app is secure, run these audit tools. Just like I didn’t know about that problematic endpoint, you might have something similar hidden in your project.
Security is not a luxury. It’s a foundation.
And tools like the one @georgecollier made available for free make all the difference for anyone building no-code in a professional way.
It’s absolutely worth testing.
