Should we validate production shiny apps, or are they better QC'd like analytic code?

An example question. But kinda a real question :) Is it sufficient to validate R packages used in a shiny app for GxP purposes, or does the app itself require some sort of assessment beyond QC by the data scientists.