--- title: TSU-10 Insecure Cloud Deployments for Mendix | Omnext description: Constants, runtime settings, headers and environment separation decide how much the model can still protect. What goes wrong around a Mendix deployment. image: https://www.omnext.com/hubfs/raw_assets/public/Cerios%20Solutions%20Theme%20-%20Omnext/omx-sept-2026/images/omx-og-default.png --- [![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20+%20Slogan.svg)](https://www.omnext.com?hsLang=en) [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en) [Mendix quality analysisMaintainability, architecture and technical debt, scored every sprint.](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysisThe S-Unit Top 10, checked automatically on every build.](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio ProFindings in the IDE, while the developer is still in the model.](https://www.omnext.com/devassist?hsLang=en)[Omnext MCPAll analysis data, ready for your AI agents and assistants.](https://www.omnext.com/omnext-mcp?hsLang=en) [Pricing](https://www.omnext.com/pricing?hsLang=en) [Resources](https://www.omnext.com/resources?hsLang=en) [Knowledge baseThe full product documentation, for everyone who works with Omnext.](https://help.omnext.com/?hsLang=en)[Fact sheetsQuality and security analysis for Mendix, in two short PDFs.](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessmentTen questions, five minutes, your security profile on screen.](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity ScanWhere your Center of Excellence stands today.](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklistTwenty-four items, your readiness score on screen.](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10Ten Mendix-specific security categories, explained.](https://www.omnext.com/s-unit-top-10?hsLang=en)[BlogArticles on Mendix quality, security and governance.](https://www.omnext.com/blog?hsLang=en)[Trust CenterHosting, data handling and certifications.](https://www.omnext.com/trust-center?hsLang=en)[All resourcesEverything in one overview.](https://www.omnext.com/resources?hsLang=en) [Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) Search [Log in](https://portal.omnext.net/)[Request a demo](https://www.omnext.com/demo?hsLang=en) Menu [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix quality analysis](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en)[Resources](https://www.omnext.com/resources?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklist](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10](https://www.omnext.com/s-unit-top-10?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en)[Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) [Request a demo](https://www.omnext.com/demo?hsLang=en)[Log in](https://portal.omnext.net/) S-Unit Top 10 · TSU-10 # Insecure cloud deployments The model can be right and the deployment still wrong. Runtime settings, constants and environment configuration sit outside the app and can undo what it enforces, and the most common way in is not production at all: it is the acceptance environment that shares a secret with it. [Take the free security self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[All ten categories](https://www.omnext.com/s-unit-top-10?hsLang=en) Where it goes wrong ## How this shows up in a Mendix application. ### Marketplace constants left at their defaults Shipped defaults are public knowledge, and they are the first thing an attacker tries. ### One secret across environments The same security-sensitive constant in test, acceptance and production, so the weakest environment sets the security of the strongest. ### Production data outside production Real data in a non-production database, protected by whatever the test environment happens to have. ### Headers and CSP too permissive Missing security headers, or a content security policy loose enough that an XSS reaches as far as it likes. ### Path restrictions only in production API documentation and internal paths restricted on one environment and open on the next. ### Session settings unconsidered Multi-session, duration and timeout left on whatever the defaults were, regardless of what the application holds. Impact ## What it lets someone do. Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in. Log in with a documented Marketplace default Move from a weaker acceptance environment into production using a shared secret Read production data out of a non-production system Reach internal paths through the environment where they were never restricted Prevention ## How to keep it out. ### Unique secrets per environment Security-sensitive constants and environment variables that differ everywhere, so one environment cannot lend its keys to another. ### Hard separation No production credentials, APIs or data outside production, and anonymised data where test data is needed. ### Same restrictions everywhere Path restrictions, headers and a strict content security policy applied per environment, and checked before each deploy. Automated ## What Omnext checks for you. Deployment configuration sits outside the model, so Omnext reports what it can see from the application side and the rest belongs in your release checklist. It is the one category where automation stops and process takes over. [See the security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en) Source ## The framework is The S-Unit's. The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words. [Read the original on the-s-unit.nl](https://the-s-unit.nl/en/tsu-10-insecure-cloud-deployments/) Keep reading ## The rest of the S-Unit Top 10. Ten categories in total. [See the full list](https://www.omnext.com/s-unit-top-10?hsLang=en). [TSU-09Insecure UI components](https://www.omnext.com/tsu-09-insecure-ui-components?hsLang=en) Next step ## Which of the ten are you sure about? Ten questions, about five minutes, results on screen. Or let the scan answer all ten with evidence from your own model. [Take the self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20-%20Inverted.svg) Automated quality and security analysis for Mendix. Build Fast. Stay in Control. ISO 27001:2023GDPRHosted on Azure (EU) Platform[Quality Analysis for Mendix](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Security Analysis (SAST)](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en) Resources[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Security Self-Assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en) Company[Partners](https://www.omnext.com/partners?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ContactCerios | Omnext B.V. Orteliuslaan 1000 3528 BD Utrecht, The Netherlands[contact@omnext.com](mailto:contact@omnext.com)[LinkedIn](https://www.linkedin.com/company/omnext/) © 2026 Cerios | Omnext B.V. · part of Cerios Solutions · KvK 09115372[Privacy policy](https://www.omnext.com/privacy-policy?hsLang=en)[Security & disclosure](https://www.omnext.com/trust-center?hsLang=en)