CodeMonster.ai · by Knomatic
Ownership

Do I own my apps?

Your data is yours, always — every object is a real table you can query and export through a documented API. Custom frontends are standard Vite/React repositories you can take anywhere. Platform-built apps run on the platform — that is the trade: governed, secure, maintained rails instead of a pile of generated code you now have to secure and maintain yourself.

The trade, drawn

Three things leave the building with you or do not. Two of them are yours outright; the third runs on the platform, and we would rather say so here than in a procurement call.

Objects are Postgres tables behind a documented REST API; custom frontends are ordinary repositories deployed through the same versioned pipeline as everything else. Platform apps are built from primitives that only run on the platform.

What the platform guarantees in exchange

The trade is not one-sided. In exchange for running on the platform, a platform-built app gets things a pile of generated code does not come with, and never has to be retrofitted with.

  • Governed rails. Your agent assembles apps from platform primitives — objects, forms, workflows, grids, screens — through approximately 100 named operations. It never freelances in your backend.
  • Auth on every request. Every call to the control surface carries a bearer token validated on every request; the agent acts with your permissions, never its own.
  • Real environments. Dev, staging and production for custom frontends with one-way, role-gated promotion; production promote and rollback are owner-only, and rollback is non-destructive.
  • Maintained primitives. The forms, workflows and permission model under your app are maintained and patched by us as part of the license, on a backend that has carried enterprise workloads for twelve years; the specific support and availability commitments are named in your agreement. You do not inherit a codebase to keep alive.
  • No generated backend to secure. There is no AI-written server code in your app to review, scan and maintain. That is the point of the trade, and the 2026 findings below are why it matters.

The 2026 findings

"You own the code" is the strongest argument the vibe-coding tools make, and it is true — you own code you now have to secure, review and maintain. Third-party research in 2026 put numbers on what that means in practice. These are reported figures; we did not run the scans.

  • A scan of roughly 5,600 production apps built on vibe-coding tools found about 2,000 critical vulnerabilities, about 400 exposed secrets and about 175 instances of exposed personal data, as reported by Escape.tech.1
  • AI-assisted commits were reported to leak secrets at roughly twice the rate of human-authored commits, as reported in GitGuardian's 2026 secrets-sprawl research.2
  • Enterprise governance guidance now treats "vibe coding" as a named risk category, per the Cloud Security Alliance's June 2026 note.3

None of this says the builders were careless. It says generated backends are a security surface, and someone has to own it. On CodeMonster there is no generated backend: platform apps run on governed rails with auth on every request, and the code your agent does write — a custom frontend — is ordinary Vite/React you can review like any other repository.

Sources · last verified 2026-08-14

  1. Escape.tech — 2026 security scan of vibe-coded production apps, as reported on the Escape.tech research blog (report permalink pending) — verified 2026-08-14
  2. GitGuardian — State of Secrets Sprawl 2026, as reported — verified 2026-08-14
  3. Cloud Security Alliance — governance note on AI-assisted development (June 2026), as reported (report permalink pending) — verified 2026-08-14

Reported third-party figures, quoted as published by the named organizations and verified on the date shown; we did not run these scans and the counts are theirs. Sources 1 and 3 currently point at the publisher's research index rather than the report itself; we are replacing them with direct report links, and any figure we cannot link directly comes off this page. Comparative claims carry a one-quarter shelf life; re-verify before quoting.

What we will not claim

  • The backend is not self-hostable. Apps run on managed cloud infrastructure we operate, built primarily on AWS; there is no build you install on your own infrastructure.
  • We do not claim platform apps export as standalone code. They are built from primitives that run on the platform; when a license ends, they stop running. Your data does not: an export window runs after termination, during which the documented API stays open so you can pull every object out. The length of that window is stated in your agreement (terms).
  • We do not claim custom domains. Not yet; every app gets HTTPS on a platform subdomain today.
  • We do not claim the platform is unbreakable. Every request is authenticated and every change is staged, previewable and reversible; that is a posture, not an absolute.

What the trade costs is easy to state. One organization license covers every builder, every app and every environment. No tokens. No credits. No meter. You bring the AI subscription you already pay for. What that covers, and what it does not, is on pricing.

If you want to see any of this rather than read it — the API, an export, a rollback — book a demo and bring the person who has to say yes.

Questions

Can I export my data?

Yes. Objects are real Postgres tables behind a documented REST API (Swagger on every instance), and grids expose the same data with filters and pagination. Nothing lives in a format only we can read.

What happens if we cancel?

Your data is yours: every object is a real table you can export through the documented API during the term and the export window after it, and custom frontends are ordinary repositories you already hold. Platform-built apps stop running when the license ends, because they run on the platform. What the platform guarantees in exchange is above.

Security hub See how it works