---
title: Tip: find the apps your staff published from AI app builders and test them as a stranger | ctxsec
url: https://ctxsec.com/items/tip-audit-ai-app-builder-published-apps-access-and-sign-in
description: "AI app builders publish in a few clicks, often from someone outside IT, and several give each app its own hostname that ends up in passive DNS. A quick audit catches the ones open to anyone."
status: "operational guidance, prompted by Claroc's Grok Build research (Nov 10, 2026)"
published: 2026-11-10
---

> AI app builders publish in a few clicks, often from someone outside IT, and several give each app its own hostname that ends up in passive DNS. A quick audit catches the ones open to anyone.

[← Tips & Guides](/tips) · [markdown](/items/tip-audit-ai-app-builder-published-apps-access-and-sign-in.md)

operational guidance, prompted by Claroc's Grok Build research (Nov 10, 2026)

2026-11-10 11:41 PM ET

### Tip: find the apps your staff published from AI app builders and test them as a stranger

- **Inventory:** check DNS and proxy logs for builder domains (grok.me, Lovable, Replit, Bolt, v0, Base44 and similar) to see which tools are in use.
- **Search for your apps:** if you have passive DNS, pattern-search those domains for your brand or team names.
- **Test from outside:** open each app in an incognito window, then sign in with an account outside your company. If either works, the app needs an allowlist, not just a login.
- **Read the scripts:** view the JavaScript the page downloads and look for names, emails, API keys or passwords.
- **Policy:** anything with internal or personal data should be restricted to invited users, with an owner, or unpublished.

Sources: [Claroc Research: GhostShares 2, Grok apps exposed xAI's business secrets and people's private data (Nov 10, 2026)](https://blog.claroc.io/ghostshares-grok-build-apps/)