How to deploy vibe-coded internal tools securely

To deploy a vibe-coded internal tool securely, put it behind company login, scan every version for leaked keys and risky code, keep API keys in secrets instead of the code, give people the smallest role they need, and keep a log of who opened it. Inhaus does all five for every app your AI tool deploys, so you mostly ask in plain words and check the results.

AI tools write working apps fast. They also write API keys into code, send data to sites nobody checked, and skip the login. These steps keep those mistakes away from your team and your customers.

Steps

1. Deploy behind company login

   Connect your AI tool to Inhaus (how) and ask it to deploy:

   Copy

   Deploy this to Inhaus as "Commission Calculator".

   Every Inhaus app sits behind sign-in with a company Google or Microsoft account. The gateway checks sign-in and access before any request reaches the app, and the app never handles passwords. A new app can only be opened by you.

2. Read the security scan

   Every deploy is scanned. Fixed rules check for keys in code, calls to outside websites that are not on your company's allowed list, and packages with known security problems. An AI review then looks for things rules miss, such as data not filtered by the signed-in user, customer data sent to third parties, unsafe HTML and the app building its own login.

   Your AI tool gets the result straight away, with a fix prompt for each issue. See Security scan.

3. Fix what it found
   Copy

   Fix the security issues Inhaus found and redeploy.

   Each fix is a new version, scanned again, so an issue only closes when the fix really worked. In the dashboard you can also use Move to secrets or Fix with AI. See Fixing issues.

4. Move API keys into secrets
   Copy

   Store my HubSpot token as a secret for the commission calculator and read it from env.

   Your AI tool calls set_secret. The value is stored encrypted, never shown again, never written to logs and never sent to the AI review. Your server code reads it as env.NAME. Never send a secret to browser code, where anyone who opens the app can read it. See Secrets.

5. Share with the right role
   Copy

   Share the commission calculator with the sales team, view only, and make sam@acme.com an editor.

   Give most people Viewer: they can open and use the app. Give Editor only to people who should deploy, read logs, manage secrets and query data. See Roles.

6. Check the access log
   Copy

   Who opened the commission calculator this week?

   Every open, share, deploy, export and blocked request is recorded. Owners see their own apps; admins see the whole workspace. See Access log.

For admins: set the guardrails once

In a company workspace, admins set rules under Admin → Policies that apply to every app. See Policies.

• Company login on every app is on by default, and no app can turn it off.
• Security scan must pass keeps apps with blocking issues out of the company directory.
• Allow public links and Allow guests from other domains are off by default.
• Allowed external domains lists the websites apps may send data to. A new one opens a request for an admin. See Allowed domains.
• Directory submission approval means an admin approves an app before everyone at the company can open it. See Publish to the company.

When someone leaves, offboarding moves their apps to new owners, removes their access and disconnects their AI tools in one step.

A quick checklist

• The app is deployed on Inhaus, not on a public link.
• The latest scan shows no blocking issues.
• No API key is in the code; keys are secrets read in server code.
• Most people are Viewers; only builders are Editors.
• You've looked at the access log after sharing.

FAQ

Next steps

• Quickstart
• Security overview
• Deploy an AI-generated app behind SSO