We test Mendix,
even for Mendix itself

We’ve been hacking Mendix since 2015, testing both customer applications and the platform itself as Mendix’s official penetration testing partner. That gives us first-hand insight into how Mendix evolves and what that means for your security.

Low-code doesn't solve everything

Mendix makes it easier to build and move fast, but low-code doesn’t remove the security risks developers and security teams need to manage.

Your Mendix app is going live. But has it been tested?

Security gets checked right before launch. Then a weak foundation turns your go-live into a delay.

Your dependencies keep changing

Marketplace modules depend on other components and libraries, allowing new vulnerabilities to enter your Mendix application. Updates to functionality, libraries, APIs and SSO integrations can introduce new security risks and configuration errors.

Developers build production apps without a security background

Mendix lowers the barrier to building software, but not every developer is trained to think like an attacker. Security mistakes can easily become part of an application without anyone noticing.

AI adds a new attack surface

AI agents are becoming part of Mendix applications, bringing new behaviour, data flows and attack paths with them. The question is whether your security approach is keeping up.

Why The S-Unit for Mendix

Securing Mendix takes more than general pentesting knowledge. We test both the platform itself and the applications built on it, and across hundreds of pentests we’ve seen where things go wrong in practice. We put that knowledge to work for your application and share it with the Mendix community.

We test Mendix before you use it

As Mendix’s official penetration testing partner, we’ve been hacking the platform since 2015, testing new releases before they go live. That gives us deep insight into how Mendix works and where its security can break.

The S-Unit Top 10 vulnerabilities

The S-Unit Mendix Top 10 is built from years of breaking real Mendix applications. It exposes the security mistakes we actually find in the field, not the ones on a generic checklist.

We share what we learn

We don’t just find weaknesses in Mendix. Through hands-on training, CTFs and knowledge sharing, we challenge the community to find them too and build more securely.

Put your Mendix security to the test

Mendix security review

Get a clear view of the security risks in your Mendix application without the depth of a full pentest. A fast way to see where your security stands and what needs attention.

Mendix Pentesting

We test your Mendix application against The S-Unit Mendix Top 10 vulnerabilities, then go beyond the checklist to uncover weaknesses specific to your application.

Mendix Security Courses

Develop your Mendix security skills from Fundamentals to Expert. In our hands-on training courses, you work with vulnerabilities from The S-Unit Mendix Top 10 and learn from an attacker’s perspective how to identify and prevent them. For experienced developers, the Masterclass offers a way to refresh existing knowledge and keep your security skills sharp.

Discover The S-Unit Top 10 Mendix Vulnerabilities

After 10+ years of testing Mendix applications and hundreds of Mendix pentests, we know where security tends to break down. Inspired by OWASP, we turned those findings into The S-Unit Top 10: the vulnerabilities we believe every Mendix team should know.

TSU-01: Insecure user roles

A correctly configured module role linked to the wrong user role can give users access they were never meant to have.

TSU-02: Insecure entity access

The entity access rule itself is incorrectly configured, exposing data regardless of which user role it is linked to.

TSU-03: Insecure microflows

Insecure microflow implementations can allow an attacker to manipulate the behavior of the application.

TSU-04: Insecure published integrations

Weakly secured published integrations can expose sensitive data or functionality to external attackers.

We challenge the Mendix community

The Mendix CTF is a Capture The Flag competition built entirely around Mendix applications, bringing together Mendix developers and security enthusiasts from around the world. From your first flag to advanced challenges, you learn to spot weaknesses, exploit them and understand how to prevent them in your own applications.

participants
worldwide

countries

A Mendix CTF for your organisation

Want to challenge your own developers? We also organise Mendix CTFs tailored to your organisation, team and learning objectives. In a hands-on setting, developers experience how vulnerabilities arise in Mendix applications and learn how to recognise them.

Getest in de echte wereld

We werken voor organisaties waar security niet mag falen.

targenio

targenio koppelt AI-agents aan bedrijfskritische systemen en wilde weten of het groeiende platform bestand was tegen realistische aanvallen.

Het assessment testte het platform aan de hand van realistische aanvalsscenario’s en leverde het developmentteam duidelijke, toepasbare inzichten op. De resultaten gaven targenio een beter beeld van waar securityrisico’s binnen de SDLC ontstaan en hoe het eerder aanpakken daarvan kostbare aanpassingen in een later stadium kan voorkomen.

Bingy

Bingy werkt met gevoelige welzijnsdata en had onafhankelijk bewijs nodig dat het platform veilig was om aan klanteisen te voldoen en verdere groei te ondersteunen.

Binnen twee weken werd de pentest uitgevoerd en het rapport opgeleverd, waarbij werd bevestigd dat er geen grote kwetsbaarheden waren gevonden. De resultaten gaven Binqy onafhankelijke validatie van de security en hielpen om pentesten een terugkerend onderdeel van de securitystrategie te maken. Daarmee ondersteunt het zowel het vertrouwen van klanten als de weg naar ISO 27001-certificering.

“The S-Unit combines in-depth expertise with a pragmatic approach. They think along critically, communicate clearly and translate their findings into concrete improvements we can act on straight away. It’s a pleasant way of working that helps us strengthen our information security further. And just as important: thanks to them, I sleep a lot better”

Firas Daoud

TAF – CTO

“The S-Unit understood from the start what we wanted to achieve, even though the path to get there wasn’t entirely clear yet. They took us along in their approach, thought ahead and switched gears quickly when needed. We could trust that it would work out, without having to keep steering. It’s a really pleasant way of working together.”

Martijn Korevaar

Gemeente Rotterdam – IT Risk & Compliance Manager

“We didn’t want to be told that we’re vulnerable. We wanted to see how far a real attacker would get. Instead of a standard report, we got insight into exactly the risks that matter most to us.”

Anonymous

Manager Tech Security

“We received professional help with a pentest of a broad application landscape. Despite the many different functionalities in our landscape, the test was fast and thorough.”

Daan van der Ham

Lead techniek - PO-VO Raad

Your primary point of contact

“Mendix makes building applications easier, but it doesn’t take security out of the developer’s hands. Understanding how an attacker can abuse what you build is part of building it securely.”

Dirk van Veen

Founder and Lead Pentester

Our Mendix partnerships

Take your Mendix security
to the next level

From identifying vulnerabilities to building more securely, we help you strengthen your Mendix security where it matters most.

We test Mendix, even for Mendix itself