Insecure UI components
Everything Mendix renders or runs in the browser is readable by anyone who cares to look. The platform decides which pages a user is shown, not what the client can be made to reveal, so anything embedded in the front end should be treated as published the moment it ships.
How this shows up in a Mendix application.
Secrets in nanoflows
API keys and credentials hard-coded in logic that runs client-side, where anybody can read them.
Constants exposed to the client
Expose to client left on Yes for a value that is not meant for the browser.
Untested Marketplace widgets
A widget adopted for what it does, with no check of whether it is maintained or has ever been security tested.
User input rendered as HTML
Values shown without validation, which is the shortest route to cross-site scripting.
Unsafe sinks in custom JavaScript
document.write, innerHTML and dangerouslySetInnerHTML used because they were the quickest way to get markup on the page.
Script-capable attributes set dynamically
An href or an event handler assembled at runtime from a value somebody else controls.
What it lets someone do.
Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in.
How to keep it out.
Nothing sensitive in the client
Sensitive values in persistent entities behind access rules, constants not exposed, and logic that must stay hidden moved to a microflow.
Safe rendering only
A purpose-built widget such as the HTML element widget instead of raw HTML, and no document.write or innerHTML.
Vet what you adopt
Check that a Marketplace widget is maintained and has been tested before it becomes part of your attack surface.
What Omnext checks for you.
Omnext inspects pages, snippets, nanoflows and JavaScript actions for hard-coded secrets, client-exposed constants and the unsafe sinks that lead to cross-site scripting.
The framework is The S-Unit's.
The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words.
Which of the ten are you sure about?
Ten questions, about four minutes, results on screen. Or let the scan answer all ten with evidence from your own model.