operational guidance, prompted by Claroc's Grok Build research (Nov 10, 2026)
Tip: find the apps your staff published from AI app builders and test them as a stranger
Inventory: check DNS and proxy logs for builder domains (grok.me, Lovable, Replit, Bolt, v0, Base44 and similar) to see which tools are in use.
Search for your apps: if you have passive DNS, pattern-search those domains for your brand or team names.
Test from outside: open each app in an incognito window, then sign in with an account outside your company. If either works, the app needs an allowlist, not just a login.
Read the scripts: view the JavaScript the page downloads and look for names, emails, API keys or passwords.
Policy: anything with internal or personal data should be restricted to invited users, with an owner, or unpublished.