Skip to main content

App Builder

App Builder is how you go from an idea to a working app without writing code: you describe what you want in plain language, and Devs.ai generates the frontend, backend, and database in a live sandbox you can use right away—the same kind of isolated environment described in Sandbox. You iterate in chat beside a live preview, then connect GitHub, deploy, and share when you are ready.

The sections below summarize what you can build (aligned with the current product), then plans and limits (paywalls, entitlements, and naming).

📝 Note: Product names and limits can change. If a control is disabled or shows an upgrade prompt, follow the in-product messaging or ask your organization admin which plan you are on.

What App Builder offers​

Together, these capabilities match what App Builder ships today. For tooling, timeouts, and API-level sandbox behavior, use Sandbox.

  • Build from a prompt — Describe your app and watch it come together in real time, with a live preview next to the chat.
  • Pick a look and feel — Choose from a gallery of design styles to set the tone before you fine-tune details.
  • Connect a database — When the app needs to store data, App Builder pauses and asks you to choose Browser Storage (quick prototype) or Connect Supabase (a real database). You can switch later from the Database panel (see Choose a database).
  • Secrets and API keys — Add credentials your app needs with masking and encryption so sensitive values are not exposed in the UI.
  • Google OAuth in your app — Wire third-party sign-in into the app you are generating, in a few guided steps (this is sign-in for the app you build, separate from how you sign in to Devs.ai itself).
  • GitHub — Push your project to a repository, pull updates, and switch branches without leaving Devs.ai, when your plan allows writes (not just browsing).
  • Deploy and share — Publish the app and control who can open it: a public link or organization-only viewers, depending on policy (see Share links and access).
  • Security assessments — Run an on-demand assessment against the app you are building, get an A–F grade and OWASP-mapped findings, and send issues back into the builder with Fix selected (see Security assessments).
  • Recover deleted apps — Soft-deleted apps go to a trash view so you can restore them later instead of losing work by accident.
  • Branding and policies — Tune how the experience looks and which rules apply before end users see it.
  • Agents in the app — Attach agents and pick models the app should call so the right automation runs behind your UI.
  • Presentations and slide decks — Build pitch decks, walkthroughs, and visual stories with AI, then refine them in the live preview.
  • Guided questions — When App Builder needs your input, answer structured questions in a short wizard instead of leaving details ambiguous.
  • Cost control on larger builds — For bigger features, review the plan, timing, and estimated cost before work starts (organizations on dollar-based billing).

If you only need a chat widget on an existing site, use Embedding an agent—that path is separate from full App Builder under Apps.

Choose a database​

When a new app needs to store data, App Builder stops and asks you instead of quietly picking a database for you.

You see a simple choice in the chat:

  • Browser Storage — A lightweight database that lives in the app itself. Best for quick prototypes and demos.
  • Connect Supabase — A real cloud database you can grow into. Choosing this opens the Supabase setup flow; after you connect, the build continues.

If you already said which option you wanted in your first message, App Builder may skip straight to confirming that choice rather than showing both buttons. You can change providers later from the Database panel in the builder.

Starting from a spreadsheet (Start from your data) still gets you to a working app as fast as possible. That path uses browser storage first and tells you that switching to Supabase remains an option later.

Live preview​

The live preview beside chat shows your app as App Builder generates it. A path bar at the top of the preview shows which route you are viewing (for example /dashboard or /settings), so multi-page apps are easier to navigate while you iterate. Click links in the preview to move between routes; the path bar updates as you go.

Organization admins can choose whether App Builder share links are reachable by anyone with the link or only by signed-in viewers in the same organization. The control lives in organization settings and applies to apps shared from your org. When you publish or copy a link, follow the labels in the product so you match what your admin allows.

Add collaborators without an email​

When you add a collaborator from the app Share modal, a Notify people option controls whether they get an email about it. It is on by default (“Send an email letting them know you shared this app with them”). Turn it off and they still get access, quietly—useful when you are setting a group up ahead of time or you already told them in person. Role updates for people who already have access do not send that email.

Plans and the pricing matrix​

Some App Builder capabilities are tied to the pricing matrix for your organization. When a capability is not included in your plan, you may see:

  • A paywall or upgrade prompt when you try to use a gated action.
  • Read-only access to parts of the experience so you can still review context (for example, GitHub or deploy-related surfaces) without applying changes until you upgrade.

Exactly which rows in the matrix unlock which builder features is maintained in the product—use the matrix and upgrade prompts as the live source of truth.

Business plan naming​

Where the product previously referred to a Team plan in App Builder and billing contexts, the same tier is now labeled Business. If you see documentation or screenshots that still say “Team,” treat Business as the current name for that offering.

Areas that respect entitlements​

Depending on your plan, the following App Builder areas may be fully editable, read-only, or hidden behind an upgrade:

  • Branding — Visual identity and related settings for what you publish.
  • Policies — Rules and constraints that apply to your app or deployment.
  • Deploy approvals — Review steps before changes go live.
  • Security assessments — On-demand scans that read your code and, on deeper tiers, attack the running app. Requires a paid App Builder plan that includes assessments; if you see an upgrade prompt, your organization needs to move to an eligible tier.

Organization admins still manage who can access App Builder at all; this page describes plan-level gates inside the builder, not the custom user permissions matrix itself.

GitHub and deploy flows​

Connecting to GitHub or moving through deploy and publish steps can each be gated separately. On lower tiers you might:

  • Browse or inspect GitHub or deploy configuration without being able to push or approve until you upgrade, or
  • Hit a paywall when you try to advance an automated step (for example auto-advance on deploy) that your plan does not include.

Upgrade prompts are aligned across these paths so you are less likely to configure something in one tab that you cannot complete in another.

When your organization uses deploy approvals, the latest security-grade seal and score from an assessment also appear in the deploy queue, so reviewers can see posture at a glance before they approve a release.

Security assessments​

App Builder can run a security assessment on demand against the app you are actually building. Deeper tiers boot the app and try real attacks, then report only issues they can reproduce.

📝 Note: Security assessments roll out progressively, organization by organization. If you do not see Run security assessment yet, the feature has not reached your organization. Contact your Devs.ai representative if you want it enabled.

What you get​

Findings are classified against OWASP Top 10 (2021) (standard web app risks) and OWASP LLM Top 10 (AI-specific risks such as prompt injection, tool abuse, and leaking secrets). Severity uses CVSS v3.1. The scan aims at OWASP ASVS Level 2 coverage—the bar many apps that handle user data are held to. That is a coverage target, not a certification.

Each completed run produces:

  • A grade from A (safer) to F (serious issues) and a score out of 100. A confirmed critical finding caps the grade at D, so a high score cannot hide a serious hole.
  • A report grouped the way OWASP groups risks, with severity, proof, and remediation guidance for each finding.
  • Confirmed findings are reproduced live. Unverified findings are worth reviewing but are not exploited during the run.
  • A PDF you can download and share. Completion emails deep-link to the results so you can open last week’s run without hunting through the UI.

Choose a scan depth​

TierTypical timeWhat it does
Quick Scan~1–2 minReads code and dependencies. Looks for hardcoded secrets, known-vulnerable libraries, and missing login checks. No live attacking.
Break-in Test~5–10 minEverything in Quick Scan, plus boots the app and tries common attacks—injection, cross-site scripting, broken logins, and data you should not be able to see. Findings you do not see are not reproduced.
Full Red Team~20–40 minFull depth, including AI-specific attacks: prompt injection, tool and connector abuse, chained exploits, and multiple rounds until nothing new turns up. Organization admins can restrict this tier to admins only.

Pick the depth when you start the assessment, then go back to building. The scan continues even if you close the window.

Run an assessment​

  1. Open Apps and select the app you want to test.
  2. From the app’s actions menu, choose Run security assessment (or open the Security view to see assessments across apps and start one from there).
  3. Select a scan depth and confirm.
  4. When the run finishes, open the report to review grades, findings, and proof.

Gallery cards show a security-grade seal after a run, so teammates can see posture without opening every app.

Fix issues in the builder​

From the report, select one or more findings and use Fix selected to send them back into App Builder chat. App Builder receives the context it needs to suggest a fix. You can also work through issues manually using the remediation notes in the report.

Admin controls​

Organization admins configure assessment policy from Apps → Policies (organization App Builder settings):

  • Who can run assessments — Allow or block members from starting scans. Admins can still run assessments when members are blocked.
  • Full Red Team access — Allow or block members from choosing the Full Red Team tier. Use this to keep the deepest, longest scans in admin hands.
  • Assessment model — Members cannot change which model runs the assessment. The product uses a strong default auto pick.

These controls are separate from custom user permissions and from deploy approvals, but reviewers see assessment grades in the deploy queue when both features are in use.

Add agents and model pickers​

When you add agents to an app, the agent and model pickers only list combinations your organization is entitled to use. If a model or agent type is missing, it is usually due to plan, organization model settings, or admin configuration—not a bug in the picker.

Kimi K3 and Gemini 3.7 Flash appear in the App Builder model picker when your organization has access through the managed gateway or catalog. For how Kimi, Gemini, and other families show up more broadly, see Configuring model and data sources.

Presentations and slide decks​

App Builder can generate slide decks—pitch decks, product walkthroughs, training visuals, and similar—in addition to full web apps.

Create a presentation​

  1. Open Apps and start a new App Builder project.
  2. Choose the presentations / slides template (or describe a deck in the prompt).
  3. App Builder generates the deck in the live preview next to chat.

Refine in the preview​

After the first draft, you can polish the deck without leaving the builder:

  • Double-click text on a slide to edit it with rich formatting.
  • Set text and highlight colors to match your brand.
  • Drag slides or blocks into place; the preview updates as you move items.
  • Hover guidance in the preview explains how to start editing when you are unsure where to click.

Iterate in chat for larger structural changes (new sections, different narrative, additional slides) and use the preview for fine-tuning copy and layout.

Guided questions when details matter​

When App Builder needs a decision only you can make—an ambiguous requirement, a design trade-off, or missing information—it can pause and ask structured questions inline instead of guessing.

  • One question at a time with clear Next and Back navigation.
  • Answer types include Single choice, Multi-select, or free text, depending on what the question needs.
  • Any question can be skipped; App Builder proceeds with its best judgment for that point.
  • Your answers are preserved if you navigate away mid-wizard and return.

This flow is available to all App Builder users. Small, one-line fixes usually run without the wizard so simple edits stay fast.

Cost and approval before larger builds​

For larger features—not quick one-line fixes—App Builder can show what it plans to do before any work runs. You stay in control of spend and scope on substantial changes.

What you see before accepting​

When the estimate appears, review:

  • Summary — A short description of what App Builder will build or change.
  • Steps — High-level steps it expects to follow.
  • Estimated duration — Realistic minutes for an AI-assisted build, plus an estimated finish time in your local timezone.
  • Estimated dollar cost — Shown only for organizations on the new dollar-based billing system. Treat it as an estimate, not a final invoice.

Accept or reject​

  • Accept — Work begins. Detailed tool activity and assistant messages for that turn live in a sub-chat you can open anytime; the main chat shows a compact status card (In progress or Done).
  • Reject — Nothing runs. Adjust your prompt or ask for a smaller scope and try again.

After a turn that changes your app completes, the done card may offer a quick way to test the result in the preview.

📝 Note: Cost estimates and upfront approval apply to organizations on dollar-based billing. Other billing models may not show dollar estimates; guided questions and presentations are not tied to billing.

Apps catalog and mobile​

On the web Apps catalog, each app card has an actions menu so you can open, share, assess, or manage an app without drilling into it first. After a security assessment completes, the card also shows a security-grade seal with the latest letter grade.

Apps v2 on mobile has received focused polish: chat and preview panels behave better on small screens, long app names use an ellipsis instead of breaking the header, and several session and control issues are fixed. The Apps catalog on the web is still easiest to manage on a desktop browser when you are doing heavy layout, policy, or security work.

  • Getting started — where to open Apps from the homepage.
  • Sandbox — how the preview and tools relate to the isolated environment.
  • Embedding an agent — embed a widget on your own site (different from full App Builder under Apps).
⌘J