Link: https://github.com/marmelab/platform

Some of my colleagues aren’t developers, but they actually build internal apps with Claude Code. Before, someone described a need, IT wrote the specs and a dev team built the app. Now people show up with an app that already works, and a lot of the time its data is hosted outside the company.

That’s hard for IT to say yes to. Each app is supposed to respect security rules, GDPR, accessibility and internal architecture standards, and checking all that app by app just isn’t realistic. So the default answer tends to be no. There’s a catch though. Saying no doesn’t stop people from building, so the apps can end up hosted anyway, outside any control, and IT loses track of what’s running and where the data is.

None of the AI platforms I reviewed let these apps run on the company’s own infrastructure with IT able to see and control every one of them. So I built one on top of Supabase.

Builders describe what they need to Claude Code, which builds and deploys the app. The normal path goes through a company GitHub repo so IT can review changes, and a deploy straight from a laptop gets flagged. IT gets a dashboard with every app, its owner, last deployment and traffic, and can stop an app, roll back a version, read the audit log or take over the apps of someone who left.

Everything runs on one VM the company controls, sized for 40 to 60 apps. Hosting costs from about €20 to €300 a month depending on the host, and with a dozen builders the Claude subscriptions actually cost more than that.

It doesn’t make apps compliant by itself though. The guardrails are narrow. A linter blocks tables without row-level security, and CI runs security checks. Row-level security keeps users out of each other’s data, but builders can see all of their app’s data, so who builds an app with sensitive data matters as much as who uses it. The first version took me about two weeks with Claude Code, and there are still about 90 known limitations, security hardening included.

I’m curious how IT teams here deal with apps their colleagues build on their own.

If you plan to host vibe-coded apps for your company, have a look at marmelab/platform. Fork it, try it, and tell me what breaks.

Everything about this is a horror story, but good job making it less-so.