Security for the apps your staff build with AI
Forculus puts every app your staff build with AI behind your company's sign-in from its first deploy. Keys stay out of app code, every deploy is scanned for leaked keys and vulnerable packages, every request let in or refused is logged, and access you remove ends within 60 seconds.
Updated
Apps built this way don't always stay private. In May 2026, researchers at RedAccess said they had found about 380,000 publicly reachable apps and other assets made with AI app builders, and that about 5,000 of them held sensitive corporate information (source).
Private from the first request
An app on Forculus has no address of its own. Every request goes through our edge, which works out who is calling and checks the app's sharing rules before the app sees anything. A request that fails any step is refused and logged. If configuration is missing or a lookup fails, the request is refused. A public path, for webhooks, has to be added by a person in the dashboard.
A signed identity, never a header
For each request it lets in, the edge sends the app a fresh signed token, valid for 60 seconds and made out to that app. It deletes any identity header a client sent first, so a client can't pass itself off as someone else. Our SDKs for Node, Python, Go and Rust check the token in one call. See Security.
No keys in app code
You store a key with us, and our outbound proxy adds it to the app's requests to that host, so it never appears in the code, the logs or a version. Each app can be held to a list of the hosts it may call. Company keys for AI providers can be given to apps with a monthly budget each. See Secrets and Sending requests out.
Every deploy scanned
Before a version goes live we look for keys left in it and check its packages against OSV, the open vulnerability database. Private keys, live Stripe keys and tokens for GitHub, Slack, npm and a few other services are always refused. For everything else the workspace chooses whether a finding warns or refuses the deploy. See Deploy scans.
Every request in the log
The audit log has every request let in or refused and every change, with who made it: a person, an agent, a token, a GitHub run or a scheduled job. It's kept 3 months on Free and Team and 12 months on Business and Enterprise. Audit streaming sends it to Splunk, Datadog, an HTTPS collector or an S3 bucket, an Enterprise feature included on Business for early customers for a limited time.
Access that ends when you say
Remove someone from an app or the workspace and their access ends within 60 seconds, open connections included. A revoked bypass token is refused on its next request. An agent has its own name and credentials, and its open connections close within 15 seconds of being revoked.
Workspaces kept apart
Every table that holds workspace data has a row-level security policy enforced by Postgres. Each app runs in its own isolate or container with its own storage, secrets and logs, and its outgoing traffic can't reach our own hosts or private addresses.
Questions
Can someone make an app public?
Not the whole app. A person can open single paths, for webhooks, in the dashboard. A publish policy can limit who may, and who may share an app outside the company.
What does a coding agent get when it deploys?
It acts as the person who signed in to the CLI, with their permissions and no credential of its own. What it does is logged under their name.
How do I report a vulnerability?
Email security@forculuslabs.tech. We acknowledge reports within two business days. See Reporting a vulnerability.
Sources
- Thousands of Vibe-Coded Apps Exposing Corporate, Personal Data: RedAccess, Security Boulevard, 7 May 2026. The figures come from RedAccess's chief executive, in interviews with Axios and WIRED. Checked 22 October 2026.