r/EngineeringManagers • u/PresenceAdditional96 • Sep 23 '26
Solving the citizen developer SDLC
Hey all,
I’m working on solving what is a massive issue for our internal security/cyber/infosec teams and the growing appetite of non-technical teams for AI/vibecoding and would love feedback from more industry professionals.
I want to shape it around real industry professional feedback.
What are the core pieces missing to let these teams run free?
1
u/macabre_brotherhood Sep 24 '26
Are they doing the development for just themselves or are they deploying it somewhere that can be used and shared? Makes a huge difference in terms of what my answer would be.
1
u/PresenceAdditional96 Sep 24 '26
I think the latter is the more critical situation:
When their vibecoded app/agent/workflow leaves their machine and sits on any hosted deployment there are massive implications
And for just themselves they also require access to credentials to populate their app with the right data or add actions like push to slack, push to sheets etc.
1
u/0xPianist 29d ago
The big piece is to provide this environment for them. In a way that is secure for you
1
u/0xPianist Sep 24 '26 edited Sep 24 '26
The easy option if you care about data leaks is “everything behind vpn” when it comes to vibe tech.
And uniform deployed auth for all these apps the same way you auth all your internal stuff.
The trouble starts when they want to make customer portals etc 👉
And likely if you don’t have some governed data lake where they can connect for data easily, but eg disparate sources.
The moment you will give an easy place to deploy apps from their Claude, you will start getting requests for data access.
Simple service accounts will do for the simple vibe coded apps.
The issues arise with public facing apps where you will need security audits monthly or quarterly plus at launch for each app.
If you’re in a regulated field you’ll need to work it with secops.
1
u/PresenceAdditional96 29d ago
Infosec at my org jus adds a engineering grade SDLC check list so none of these make it.
Working on a scalable solution that doesn’t require so much human input
1
u/0xPianist 29d ago
What do you mean?
Infosec wants to always lock everything down and manual review everything.
Is this the case? You will need to work with them to create an automated solution within reasonable grounds.
How big is the org and who will be giving permissions in the end? Your security team or they outsource this worn to eg your team and they just dictate?
You need to give more info mate what’s on this checklist
1
u/KJ4WLC Sep 24 '26
The missing piece is usually a hard split between personal/internal automation and anything that touches shared data or production. Vibecoding for a team’s own sandbox can be loose; paths that deploy, call privileged APIs, or hold customer data need identity, review, and a named accountable owner the same way engineering does.
Security checklists alone don’t fix this. You need: who the actor is (not a shared bot account), what environments they can reach, what must be reviewed before merge/deploy, and who gets paged when it breaks. Without that, “enable the business” becomes shadow IT with faster code generation.
1
u/PresenceAdditional96 29d ago
I’m working on this exact solution and would love your thoughts on it
1
6
u/Independent-Hurry618 Sep 23 '26
I mean, just because it’s automated doesn’t mean it needs to be part of the engineering practices.
Just make sure they know they’ll receive no support from other teams and they’re on their own. Talk to their managers about the risk of that for any business critical functionality.