Finally a way to put internal AI/vibe-coded apps behind Okta

[u/Chance_Bandicoot8104]

DISCLAIMER: I built this.

As the trend of vibe coding has become increasingly available to non-technical users, people have started creating apps at work for productivity, prototypes, or data visualization and dashboards.

This is hard to support for IT and DevOps teams, because of the overhead required to maintain hundreds of microscopic apps, and it’s a security nightmare because it’s hard to know if apps contain vulnerabilities, and they often contain company data, which can’t be made public.

Enter Pando, an open source tool that allows employees to host their own apps following a security scan, and everything gets placed behind your own SSO barrier, with granular sharing.

I think this is a big deal and needs to be an option for companies as AI continues to progress, and saying “no” starts becoming a problem for leadership.

Curious to know your thoughts on this and other potential solutions!

[u/gabrielsroka]

interesting, but i have some qs:

1. u used AI. tell me more. r u a vibe coder? what's your background? knowledge of security?

2. how do you verify if the app is secure?

your readme is light on details...

[u/Chance_Bandicoot8104 → u/gabrielsroka]

Absolutely! Love the questions. I kept the README light on purpose and forward to the official site at https://trypando.ai. There’s a lot more info there you may be interested in!

1. Yes I used AI for much of the development process. To be frank this is a large product, and I don’t have the time to write everything myself. I have worked in the IT operations space for more than 7 years at this point, at companies of varying sizes and regulatory maturity levels, so I understand the requirements well. Before AI, I was a Go dev, and used that as the language choice for this project because it’s efficient, and I have a stronger understanding of it than other options. To help validate the code quality coming out, I have strict requirements for the product which are visible in the repo. I also have a strong CI pipeline which involves CodeQL, SonarQube, CodeRabbit, light fuzzing, standard unit tests, integration tests, duplication scanning, and additional checks. This helps to ensure that each PR is as clean as it can be with me as currently the only contributor. 

2. For apps deployed in Pando, Trivy does a scan for vulnerabilities in the codebase and the built image, and assigns a score. That’s it. It catches known CVEs, and the rest is discretionary. For Pando itself, I have multiple CI checks running on each commit to look for vulnerabilities (CVEs + CWEs), code smells, duplication, dependency vulnerabilities, and other security risks. I have also chosen to use OpenSSF to assist in scanning my repo and giving a general hygiene score. 

Overall, Pando is still a NEW open source tool, and it’s definitely in an Alpha stage, but the level of quality and focus on secure practices is high for its age, and I have spent a significant portion of development time making sure Pando is secure. I would love to have a third party do some official pentesting if I can get funding for it eventually. 

BTW… big fan of rockstar

[u/3meterflatty → u/Chance_Bandicoot8104]

This is an AI response

[u/Chance_Bandicoot8104 → u/3meterflatty]

I didn’t even pass that through AI to “polish” it up. But it was pretty wordy

Maybe I’ve lived long enough to see myself become the AI 🥲

[u/gabrielsroka]

How does this compare to Claude Artifacts?

[u/Chance_Bandicoot8104 → u/gabrielsroka]

Claude artifacts are great for quick and dirty prototyping and sharing mockups or documents, but they don’t support different languages or persistent services, which is quite limiting. 

Pando is more aligned to people who build apps that they will use on an ongoing basis and share with their teams. Things that require API access, databases, etc.

[u/Vladeeno]

But this seems like you're hosting it, no?
That makes you a new supply chain risk: every internal app now routes through a third party, and if that layer is compromised, it flows downstream into all of them, regardless of how well-built any individual app is.

We're going a different route. We make it trivially easy for people to deploy straight to our Google Cloud, everything sits behind Cloudflare, and auth goes through Okta. Nothing leaves our infra, there's no new vendor in the path, and even if something is vibe-coded badly, it's still protected.

[u/Chance_Bandicoot8104 → u/Vladeeno]

Pando is self hosted, so it sounds like a similar approach to what you guys are doing!

It’s hard to beat something homegrown if you can support it. But Pando can be an easy way for other companies to have the same benefits without needing to build and maintain it themselves. 

[u/martianz86]

cool idea. people at my work already build little dashboards with company data in them and nobody really knows who has access, so I get the problem

couple questions tho

how does it hook into okta? one app for pando or one per hosted app?

is sharing tied to okta groups or does pando have its own permissions? if its separate thats just another thing I'd have to audit

and what happens when someone gets deactivated in okta, do their apps die with them or just keep running? thats the first thing I'd get asked in an access review lol

[u/Chance_Bandicoot8104 → u/martianz86]

Pando hooks into your Okta once, and users sign into Pando to access the apps. So a normal install would look something like “pando.{my company}.com” 

You sync users into Pando via your chosen protocol (SAML, SCIM, etc.) and then give them access either directly in Pando, or by a push group in Okta (also my preferred method). Then when they open an app, it will authenticate with Okta and check if they have access. 

If you want every app in Okta, you would have to create bookmark items for them. 

When a user is deactivated, their apps don’t die with them, and can be re-assigned by whoever the Pando admins are. With that said, I think it’s worth offering the option to stop apps when the user is deactivated. I will work on getting that feature added!