Chendo
released this
2026-08-12 12:36:40 +00:00
| 54 commits to main since this release
⬇ Downloads
Version 0.108.1
- IMPROVED Third-party license notices now ship inside the extension. A
THIRD_PARTY_NOTICES.txt with the full license texts of the bundled open-source components (preact and @preact/signals under MIT, axe-core under MPL-2.0) is included in the package and regenerated on every build, so attribution travels with every download.
Earlier versions (v0.108.0 … v0.90.0)
Version 0.108.0
- FIXED Sharper security checks. Sensitive field/attribute names are now caught anywhere in the name, not only at the start (e.g.
AccessToken, OrderStatus, UnitPrice); the internal-IP leak scan now matches the common 192.168.x and 172.16–31.x ranges; and a false-positive "inline script" flag on empty-named widgets is gone.
- FIXED Reliable per-element restyle. Editing several elements no longer lets two look-alike widgets overwrite each other in the export, and re-selecting an element you already changed now resets it fully.
Version 0.107.0
- NEW Export your restyle as SCSS (Design ▸ Restyle ▸ Per element). Every element you tweaked is collected into one copy-paste SCSS patch. Where a colour matches a design token, the patch points at the token and its source file — so you change the token in the theme instead of hard-coding a hex. Export to a file or copy to the clipboard.
- IMPROVED Less clutter in the element editor. The common controls (colours, size, weight, padding, text) stay up front; line height, letter spacing and margin move behind "More options".
Version 0.106.0
- NEW Restyle a single element (Design ▸ Restyle ▸ Per element). Pick any element in the running app and tweak its colours, font size/weight, line height, letter spacing, padding, margin and even its text — live. Changes are non-destructive (F5 or "Reset element" puts it back). The old theme playground is now the Whole page scope of the same tab.
- IMPROVED Playground is now "Restyle". The Design tab's live editor got a clearer name and a scope switch — Whole page (remap a colour everywhere, swap the font, free CSS) or Per element.
Version 0.105.0
- NEW Measure on the page (Design ▸ Tools ▸ Element inspector). Pin one element, then hover another: the spacing between them is drawn as lines with pixel labels, and edges that line up show dashed alignment guides. The hovered element also gets its margin (orange) and padding (teal) frame. Design review without leaving the running app.
- IMPROVED Plainer names in Design ▸ Audit. The extra-checks now explain themselves: "axe-core" is labelled Deep WCAG scan, and every check has a one-line tooltip in plain language (what "headings & landmarks", touch targets and contrast actually mean) — so non-developers know what each one does.
Version 0.104.1
- IMPROVED Active tests are compact now (Advanced build). Each test is a single row you expand for its description and results, with a "Run all tests" button that runs them one by one and a running total of findings. A test that finds something expands itself.
Version 0.104.0
- NEW Secret in browser storage. Flags a
localStorage/sessionStorage entry holding a secret-looking value (token, key, password) — readable by any script on the page. Keep secrets out of web storage.
- NEW Anonymous data reach (Advanced build only). A new active test retrieves entities without logging in and flags which the anonymous role can read — the classic over-permissioned Anonymous role. Read-only; microflows are not executed.
Version 0.103.1
- FIXED S-Unit finding links now open the exact topic. Clicking an S-Unit tag on a finding used to open the general Top-10 page; it now links straight to that item's detail page (e.g. TSU-04 → its "Insecure published integrations" page), which has the fuller explanation.
Version 0.103.0
- NEW Sensitive field in a published service. Flags a published REST/OData resource that exposes a field named like a secret (password, hash, token, IBAN…) — published attributes do not inherit entity access, so consumers can read them.
- NEW Write access to a security/status attribute. Flags attributes your role can write whose name suggests security or status (status, role, is_admin, owner, amount…) — a client can tamper with them (privilege escalation / mass assignment). Set those only in a microflow.
- NEW Information disclosure in responses. Flags a response that leaks a stack trace, internal IP or private key — verbose errors that should stay server-side.
- IMPROVED Strict-mode hardening tip when the app allows ad-hoc client queries.
- NEW Active tests: cross-tenant row exposure & file entities (Advanced build only). Cross-tenant retrieves rows and flags entities that return other users' data — a missing owner XPath constraint (the classic data-exposure bug). File entities lists downloadable document types to check their access. Read-only, behind the authorisation you sign.
Version 0.102.1
- IMPROVED Security checks focus on what you configure, not on the platform. Removed the "auth posture" active test (CSRF and sessions are enforced by the Mendix runtime, not by your config, so it added no actionable value), and grouped the security-header tips into a single low-priority hardening note (most Mendix apps lack a custom CSP by default — it is a hardening opportunity, not a mistake you made).
Version 0.102.0
- NEW Active tests completed (Advanced build only). Alongside the unauthenticated-access check, the Active tests view now also does: reflected XSS (a unique marker in query parameters, flagged if it returns unescaped), injection signatures (crafted input that leaks a server error), privileged microflows (lists client-callable microflows with a privileged-looking name — enumeration only, nothing is executed), and an auth posture check. All same-origin and non-destructive, behind the per-target authorisation you sign. Use it on your own apps, responsibly. None of this ships in the store build.
Version 0.101.0
- NEW First active test: unauthenticated access (Advanced build only). Once you confirm you are authorised, the Active tests view can call an app's published GET endpoints without logging in and report which return real data — confirmed exposure, not just reachability. Read-only, same-origin, capped. Use it on your own apps, responsibly.
- IMPROVED The store build no longer contains any active-test code. The Advanced build is now compiled separately, so the offensive code ships only there — the normal (store) build is built without it entirely.
Version 0.100.0
- NEW Active tests — foundation (Advanced build only). The Advanced build gets a new Security ▸ Active tests view for confirming findings by actively probing an app. This first step is the safety framework only: before anything can run you must confirm you are authorised to test the app (that confirmation is logged and is your risk sign-off). The actual tests arrive in a later build. Core rule, as everywhere in this tool: use it on your own apps, and use it responsibly. Not present in the store build.
Version 0.99.1
- IMPROVED Security ▸ Checks looks tidier before you run it. Instead of a large empty area, the tab now shows a compact intro with the run button; the results and their scroll appear once you run the checks.
Version 0.99.0
- IMPROVED Access moved back to the Data tab. The entity-access matrix is a lens under Data ▸ Access again (where it shares the entity sidebar), and the Security tab now focuses purely on the Checks. If you had it open in Security, the tool takes you to Data ▸ Access automatically.
- FIXED Calling a published endpoint no longer fails on the declared address. Some OpenAPI docs declare an internal address that is not where the app actually runs. The tool now always calls the endpoint's path on the app's own origin, so a call works regardless of what the doc claims — and still never leaves the app's origin.
- NEW Filter and collapse in Security ▸ Checks. Click a severity in the summary to filter the findings to it (click again to clear), click a finding's header to collapse it, and collapse/expand all at once.
Version 0.98.1
- FIXED Security ▸ Checks now scrolls and keeps its results. The findings list scrolls when it is long, and the results stay put when you switch to another tab in the tool and back (they are kept for the session — but never written to disk, since a finding can contain a secret value).
Version 0.98.0
- FIXED API calls to your own app are no longer wrongly refused. When a published service's documentation declared an
http:// address while the app runs on https:// (same server, different scheme), the call was blocked as "not the app's own origin". The tool now recognises the same host and calls it on the page's own origin — only a genuinely different host is refused.
- FIXED Development mode is no longer flagged on localhost. Running locally is supposed to be in development mode, so the security checks no longer raise it there — only on a reachable, deployed environment.
- NEW XSS-sink hint. The security checks now point out suspicious client-side spots —
javascript: links, inline event handlers, a <script> inside content — that may render unsanitised input. Heuristic: it flags spots to review, it does not confirm a vulnerability.
- NEW Outdated client-library check. Flags a legacy front-end library on the page (e.g. an old jQuery, or Dojo from the classic client) whose version carries known vulnerabilities.
Version 0.97.0
- NEW Excessive-read hint. The security checks now point out attributes your role can read but that the app never actually fetched in the traffic seen this session — a hint that a read right may not be needed. It is coverage-bounded (only what you visited), so it is a guided pointer, not a verdict.
Version 0.96.0
- NEW End-of-life runtime check. The security checks now flag an app running on a Mendix major version that is past support (no more security fixes) — checked offline against a bundled list that ships with each release, so no data ever leaves your browser.
Version 0.95.0
- FIXED The Security tab no longer follows the Data tab's selection. The Access lens now keeps its own focused entity, so opening it always starts on the matrix and clicking an entity there no longer changes what the Data tab shows. No more confusing cross-tab coupling.
- IMPROVED The secret-constant check now shows the value. When a client constant holds a secret-looking value it is already readable by every user, so the finding now shows it (truncated) next to the constant name — you see exactly what is leaking and can act on it.
Version 0.94.0
- NEW Transport & session checks. The security checks now flag an app served over plain HTTP, a missing HSTS header on an HTTPS app, and mixed content (http resources loaded on an https page). Rounds out the connection-security checks.
Version 0.93.0
- NEW Secrets-in-constants check. The security checks now flag Mendix constants delivered to the client that hold a secret-looking value — API keys, tokens, a JWT, a private key. Anything in a client constant is readable by any user, so it is effectively public. The finding lists the constant names only and never reprints the secret value.
Version 0.92.0
- NEW Security is now its own tab. The access matrix and the security checks moved out of Data into a dedicated Security tab with two lenses: Checks (configuration & exposure findings) and Access (the entity-access matrix). Data now focuses purely on your records, model, graph and client state. If you had the Access lens open, the tool takes you to the new tab automatically.
Version 0.91.0
- NEW Anonymous-exposure checks. The security checks now also probe your app without logging in (credentials-less, same-origin) and flag — as critical — anything that answers anyway: service documentation (
/rest-doc/, /odata-doc/, /ws-doc/) or an OData model ($metadata) reachable by anyone on the internet. It only flags a real response, never a login page.
- IMPROVED Finding labels link to the standard. Each finding's standard tag (OWASP, OWASP Low-Code, and the S-Unit Top 10) is now a link, so you can click straight through to read more about the risk.
Version 0.90.0
- NEW Security checks in the Data ▸ Access lens. A new "Run security checks" button scans your deployed app — as the logged-in session, same-origin and read-only — for common Mendix security issues and lists them ranked by severity, each tagged with the public standard it maps to (OWASP / OWASP Low-Code & the S-Unit Top 10). First checks: exposed service documentation (
/rest-doc/, /odata-doc/, /ws-doc/), OData $metadata exposing your model, development mode still on, a default/demo account in use, a session cookie readable by JavaScript, and missing security headers (CSP, clickjacking protection, nosniff). It is an aid, not a full audit — tip: run it while logged out too, to see what anonymous users reach.
Downloads