Upland Parcs – Vibe-Coded Intranet: Security Check Before Rollout

Starting point

Without an in-house development team, Upland Parcs built a complete intranet by vibe coding with an AI coding agent. It covers time tracking, vacation and shift planning, a wiki, dashboards, and an internal AI assistant with access to company knowledge.

Before rolling it out to the team, one question mattered most: does everyone really see only the data they are allowed to see? With AI-generated code, you cannot simply assume that; you have to check it.

Solution

A structured security and data check with read-only access:

• Secret scan across the code and the entire version history
• Row level security: all database policies checked against the migrations
• Role tests: test users for each role accessing the interfaces directly with real logins, including bypass attempts
• AI assistant: permissions, tool approvals, and prompt injection tested
• Integrations: permission matrix for all connected external systems

We prioritized the findings as high, medium, and low and fixed the most important ones right away. This was followed by a deep dive on how the team can keep developing safely with AI coding agents.

What matters for AI-built software before go-live is covered in our post Taking vibe-coded apps to production. We ran a comparable check for 123-MPU’s Lovable platform.

Scope of the check

• Database with row level security and role model
• Authentication and permissions across all roles
• Internal AI assistant with access to company documents
• External integrations and their permissions
• Development process with AI coding agents

Results & impact

• Core question answered: nobody can access colleagues’ data; all role tests matched the target state
• Row level security active on all tables
• The AI assistant respects permission levels and shows each role only approved documents
• Few, prioritized findings, with the most important ones fixed right away
• Cleared for rollout to the entire team