Ultimate Build Power, Itty Bitty Security Controls - OWASP's New Top 10 for Citizen Developer Risk

### Overview In this presentation, Kayla Underoffer and Shauna introduce the relaunch and refactoring of OWASP's project targeting risks associated with citizen development, formerly known as the OWASP Low-Code/No-Code Top 10. Originating over three years prior, the initiative shifted focus from solely low-code/no-code platforms to the broader category of citizen developers who now leverage low-code/no-code, AI-assisted coding tools, and autonomous AI agents. The project aims to empower security and governance teams to secure internal enterprise applications built by non-traditional developers while remaining accessible and approachable for business builders themselves.

### Key Topics - **Evolution from Low-Code/No-Code to Citizen Development:** The expansion of tooling—such as AI coding companions and agent platforms alongside business innovation suites—necessitated reframing the project around the builders rather than a single technology stack. - **Reframed Scope and Scenarios:** The project transitioned from traditional "attack scenarios" to "example risk scenarios," emphasizing that misconfigurations and governance oversights present significant organizational risk even before an adversary exploits them. - **Human Biases in Tool Usage:** The core challenge of modern citizen development is rooted in automation bias (believing machine output is inherently correct), availability heuristic (picking the most convenient option), and anchoring bias (fixating on the initial flawed output). - **Future Project Roadmap:** Following the relaunch, the team is calling for community adoption, metric collection, and survey responses to transition from legacy low-code prioritization data to quantitative, data-driven prioritization reflecting modern AI-assisted citizen development.

### Technical Details & The Blind Trust Secure Framework A major addition to the updated list is **Blind Trust**, introduced as the number one risk. Blind trust occurs when a user takes a tool or machine output at face value without evaluating its accuracy and security, deploying solutions directly into production. Rather than trying to eliminate user trust, the speakers outline the **Blind Trust Secure Framework**, an operational model composed of three core actions designed to make security the default path of least resistance: 1. **Acknowledge Fundamental Biases and Secure the Default:** Because citizen developers prioritize speed, simplicity, and immediate access, security controls must be built-in. Platforms must automatically enforce least privilege access across governed data connections and incentivize builders by providing vetted, secure component libraries that are easier to use than custom code. 2. **Extend Governance Scope to Citizen-Built Apps:** Eliminate the assumption that citizen-developed tools exist outside organizational rules. Classifying citizen applications as governed extensions of the core business ecosystem ensures continuous visibility into permissions, data access, compliance policies, and application ownership to prevent orphaned software. 3. **Secure Innovation Through Trust at Every Stage:** Implement automated systems that instantly flag architectural drifts from secure patterns, supply just-in-time guidance and documentation, conduct pre-deployment checks, and execute continuous production monitoring to handle application sprawl at scale.

### Takeaways Citizen-developed applications frequently access sensitive corporate data in finance, human resources, and operations. Security teams must accept that trust in automated and AI-driven platforms is inevitable and channel that trust through automated guardrails and secure defaults. The project organizers emphasize community participation via their Slack channel, upcoming GitHub repository updates, and survey feedback to refine risk rankings and expand outreach to non-technical business audiences.