How to secure vibe-coded apps from prompt to production

👋 Hello, Retool community!

Last month, we rebuilt our app builder from scratch. This month, we want to tell you what that actually means for the people who have to sign off on the apps you vibe code.

“Prompt to production” has started to feel like a hand-wavy promise anyone can make. In Retool, it means something more specific: the access policies and deployment standards your organization has already defined are enforced at every step of the build and ship experience. Builders can’t see the credentials behind connected resources. Write operations to production data require explicit review before they run. Any code the agent writes is analyzed before it can be saved or run. The permission model is additive: it starts from what IT configured at the resource level, not what the builder asked for.

Senior Product Director Neena Thomas wrote the technical breakdown of how identity syncs at login to what happens to the audit trail after an app goes live.

🚀 What’s new

New models for app building
You can now build with Claude Sonnet 5, Claude Fable 5, and the GPT-5.6 model family (Sol, Terra, and Luna). Admins can set a default provider and model in AI settings. Claude Sonnet 5 is available on paid plans with a Retool-managed key; the others require your own key on Enterprise.

Agent-generated clarifying questions
The agent now asks clarifying questions before building—multiple-choice or open-ended—so it has what it needs to get the first draft right.

Trigger workflows from apps
Apps can now call workflows directly from the new builder. Open the Chat tab, reference the workflow by name, and the agent wires it up.

Upload files as app assets
Files uploaded in the Chat tab can now be used as actual app assets—embed a PDF, drop in a company logo, present images in-app.

Classic app conversion improvements
Custom components and org-level themes can now be converted to the new builder. The agent recreates custom components with minimal changes and applies your existing theme's styles.

Microsoft Graph integration
Native integration for Microsoft 365 services via the Microsoft Graph API. Connect with OAuth 2.0 or Microsoft Azure Identity to read and manage Entra ID users, mail, calendars, OneDrive and SharePoint files, and Teams messages.

🛠 Check out the changelog to see everything we’ve shipped.

🗓 Find us IRL in August:

August 4–6: Ai4, Booth #527 (Las Vegas), catch both of our sessions:

Tuesday (2:35–2:55 PM): Strategic Sr. Sales Engineer Bruno Costa presents Why Governance, Not Models, Is the Real Bottleneck to AI ROI .
Wednesday (3:40–4:00 PM): Developer Advocate Angelik Laboy Torres is presenting Who's Watching the Agents? A Practical Framework for Multi-Agent Governance

August 17–19: CIO 100 Awards and Conference (Frisco, Texas)

📺 Watch on demand

🌍 Trending in the Community

Free Retool Templates / UI examples (20+) → @JoeyKarczewski (Bold Tech) shared their team's template library: ops, AP, and QA workflows, ready to borrow.
Best architecture for a scheduled content audit across 78 public pages? → @Cagatay_Aydin's Workflows question got a thorough answer on loop design, retries, and idempotent upserts.
Single REST resource for geolocation, WHOIS, and 60+ APIs → @Furqan_Ashraf's take on consolidating external API calls into one resource instead of many.
How to reduce your Retool main storage DB size (self-hosted) → Alice's guide to trimming page_saves and audit_trail_events without losing what you need.

💼 Hiring? Looking? Drop yourself or your listing into the Retool Jobs & Opportunities megathread on Reddit.

🗓️ Got Retool questions? Join Office Hours every Tuesday and Thursday at 11am PT.

Not a member yet? Join the community—it’s not the same without you. 🤗

See you next month! ☀️

Kelsey McKeon

Content @ Retool