The S-Unit Top 10 for Mendix
Ten categories of security risk specific to Mendix, drawn from hundreds of penetration tests. Each one explained, and each one checked automatically by Omnext.
Ten categories, in the order The S-Unit publishes them.
The numbering is an index, not a ranking. What matters is that all ten are covered, on every application, on every change.
The framework is The S-Unit's.
The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words.
An OWASP Top 10 does not know what a microflow is.
Written for the platform
Generic web application risk does not describe entity access, module roles or published OData. This list does.
Built from what gets found
The categories come from real penetration tests on real Mendix applications, not from a taxonomy exercise.
Checkable by a machine
Every category maps onto something you can see in the model, which is why it can run in a pipeline instead of once a year.
Questions about the framework
Does this replace the OWASP Top 10?
Is the numbering a severity ranking?
Does Omnext check all ten automatically?
Do we still need a penetration test?
See where your own applications stand.
The security self-check takes four minutes and asks one question per category. The automated scan answers the same ten with evidence.