• Getting Started
• What is ACR?
• Activate your ACR license
• Registering your Mendix account
• What you need to know about reviewing Mendix apps
• Activate super fast model review
• Perform your first review
• What to do after the review
• Support & Feedback
• Licensing
• Managing your Enterprise license
• Adding apps and inviting people
• Configuring a custom special user
• Compatibility
• Quickstart Guide
• Dashboard
• Violations
• Modules
• Widgets (preview)
• Libraries (preview)
• Introduction
• What is a Java dependency?
• Why do you need a jar?
• Why are jar files problematic in Mendix?
• Feature overview
• Potential security risks in your Java libraries
• Duplicate Classes
• [View details] to see more articles ...

• Security (28)
• Access rules in multi-tenant apps should lead to CurrentUser
• Anonymous users should only be allowed to create non-persist...
• A project administrator should only be able to create admini...
• A strong password policy should be set
• Constants should not be exposed to the client
• Demo users should be turned off
• Entity access default rights for new members should be None ...
• Entity access rules should be using attributes/associations ...
• Hash Algorithm should be BCrypt or SSHA256
• If an anonymous user is allowed to change objects, constrain...
• Only "admin" roles should manage other users
• Only named/registered users should be allowed
• Project security must be checked
• Retracted Mendix versions should not be used
• Security should be enabled and set to Production
• Unlimited string attributes should not be editable by anonym...
• User roles with a certain amount of module roles should be c...
• Access rules in multi-tenant apps should have an XPath const...
• Always use the inherited entity to create records for System...
• Attribute widgets in data views should be editable
• Entity access should be applied when generating documents
• Microflow called from the client should apply entity access ...
• Microflow should only have permissions if used from a page
• Published Rest and Web services should require authenticatio...
• Constants should not be used for sensitive information
• The default administrator name should be changed
• Users should be signed in with a maximum of one session
• Use user libraries without security vulnerabilities
• REST calls with templates should be escaped
• Page URL's should be checked (Dec 2022)
• Reliability (41)
• Attributes should not be re-assigned in create/change object
• Chain of "if/else if" statements should have different condi...
• Check for empty string should be done properly
• Conditions should always include at least one variable
• Day of year should not be used in parse/format date time fun...
• Delete behaviour should have error message if blue
• Empty variables should not be used in actions that throw nul...
• Entity events should have either no or exactly one handler
• Entity validation rules should have an error message
• Events should be triggered when doing a commit
• Expressions for "then" and "else" in an "if" statement shoul...
• Function arguments should be different
• Hour format should be specified correctly in parse/format da...
• Identical expressions should not be used on both sides of a ...
• Lists operations should be passed different arguments
• Lists should not be modified during iteration
• MM and mm tokens should be used correctly in parse/format da...
• Objects should not be dereferenced after failing an empty ch...
• Only non-empty objects should be dereferenced
• Only variables that are not empty should be returned or assi...
• REST/Web service should have custom error handling
• REST/Web services should have a timeout
• Seconds token should be specified correctly in parse/format ...
• Short-circuit logic should be used correctly to prevent null...
• Substring function invocation should make sense
• System.User and System.Session objects should not be created...
• Variables should not be indirectly compared to empty
• Week year should not be used in date formatting or parsing
• Associations should specify a delete behaviour
• Check for negative conditions in XPath should be done using ...
• Declared variables should be used
• Imported data should be committed or stored in a variable
• Return expressions for a flow should be different
• Type parameters in a java/script action should be used
• Variable CurrentUser should only be used in a user context
• Variables should not be self-assigned
• Microflow should allow concurrent access
• Module roles should be assigned to a project/user role
• Returned variables should be used
• AM/PM indicator should only be used in combination with lowe...
• Prevent duplicate classes in jars
• Performance (29)
• Calculated attributes should only have fast actions
• Commit entities in the same order in different microflows to...
• Commits should take place outside of a loop
• Dropdown reference selectors should be used sparingly
• Entity should have a maximum of N calculated attributes
• Project role should have at most one module role per module
• Event handler after event should have fast action
• Event handler before event should have fast actions
• Page button synchronous microflows should only have fast act...
• Page data source microflows should only have fast actions
• Page on change microflows should only have fast actions
• Page widget microflows should only have fast actions
• Checking for empty on associations should be done without re...
• Scheduled events should be executed with reasonable delay
• Entity should have a maximum of N indices
• Entity should have a maximum of N reference set associations
• Many-to-many associations should have owner "Default"
• Microflow retrieve from database and aggregate should be adj...
• Microflow should not apply entity access
• Microflows should perform database actions at the end
• Not/or expressions in XPath should be avoided when the path ...
• Only short actions should be used in a loop
• Positive conditions should be preferred when retrieving data
• Retrieve & aggregate combo should not be nullified by using ...
• Retrieves over the same association should be grouped togeth...
• Loops should not have loops inside
• Persistent entities should have indices
• The Uniqueness Validation should be set to Database
• Keep the number of index columns low
• Architecture (16)
• App store modules should be unchanged (preview)
• App store modules should use the latest version (preview)
• App store widgets should be unchanged (preview)
• App store widgets should use the latest version (preview)
• Associations should only rarely be cross-module
• Entities should not be associated with a system enty
• Entities should not inherit from Administration.Account
• Entities should not inherit from a system entity
• Inheritance should be limited to 2 levels
• Microflow should be simple (cyclomatic complexity)
• Microflow should be simple (CLEVR complexity)
• Microflow should not have loops in the flow
• Microflows should not call themselves
• Microflows should only rarely call microflows from other mod...
• Retrieve by association from persistent to non-persistent is...
• Minimize the use of self-relations
• Maintainability (28)
• Actions in a flow should be different
• Custom error handling should be logged
• Custom error handling should not be "Continue"
• Entity should have a maximum of N access rules
• Expressions should be simple
• Module should have a maximum of N security roles
• The latest Mendix version should be used
• URL endpoints should not be hard-coded
• Entity should have a maximum of N associations
• Entity should have a maximum of N attributes
• Entity should have a maximum of N event handlers
• Entity should have a maximum of N non-required validation ru...
• Entity should have a maximum of N validation rules
• Exclusive split should have a descriptive caption
• Log message nodes should be consistent
• Microflows should be simple or be documented
• Microflow should have a maximum of N actions
• Microflow should have a maximum of N annotations
• Microflow should have a maximum of N ends
• Microflow should have a maximum of N loops
• Microflow should have a maximum of N merges
• Microflow should have a maximum of N parameters
• Microflow should have a maximum of N splits
• Module should have a maximum of N entities
• Module should have a maximum of N flows
• Styling should be done using sass
• Project should have a maximum of N user libraries
• Project should have a maximum of N widgets
• Project hygiene (32)
• Actions should use the default color
• After startup project microflow should be named properly
• Associations should contain the name of the associated entit...
• Attributes names should not start with their entity name
• Before shutdown project microflow should be named properly
• Calculated attribute microflows should be prefixed correctly
• Complex pages should have documentation
• Complex microflows should have documentation
• Documents in a module should be organized in a good folder s...
• Entity names should be unique across the project
• Enumerations should be prefixed correctly
• Event handlers should be prefixed properly
• Flows should only be modeled to the right and downwards
• Flows without permissions should be prefixed properly
• Folders should contain at least one document
• Folders should contains only a small number of documents
• Folder structure should not be too deep
• Health check project microflow should be named properly
• Large entities should have documentation
• Layouts should be prefixed properly
• Microflows called from pages should have a name based on the...
• Microflows called from published services should be prefixed...
• Microflows name should be based on the object it is operatin...
• Module should have a maximum of N excluded items
• Only folders should be the direct children of a module
• (Removed) Postfix on enumeration
• Project navigation microflow should be named properly
• Project should have a maximum of N modules
• Scheduled event microflows should be prefixed correctly
• Snippets should be prefixed properly
• Sub-microflows should be prefixed correctly
• Sub-Microflows that are used in Nanoflows should be prefixed...
• There should be no ToDo annotations in the project

• CLEVR Dev Suite
• 3.4.1 and later
• 3.4 (September 27th, 2023)
• 3.3.1 and later
• 3.3 (December 6th, 2022)
• 3.2.1 and later
• 3.2 (September 20th, 2022)
• 3.1
• 3.0.1 and later
• 3.0
• 2.8 and later
• 2.7
• 2.6
• 2.5
• 2.4
• 2.3
• 2.2
• 2.1
• 2.0
• 1.12
• 1.11
• 1.10
• 1.9
• 1.8
• 1.7
• 1.6
• 1.5
• 1.4
• 1.3
• 1.2
• 1.1
• Steps for August 2024 release

• Pipelines
• Jobs
• New pipeline
• Pipeline runs
• Environment settings
• App settings
• General settings
• Connected accounts
• API keys
• Enablement
• ATS Job
• ALT Job
• CI/CD Job

• Security scans
• New scan
• Compare
• App settings
• Users
• Entities
• API Keys
• Enablement

• Swagger
• Authentication
• Error handling
• Releases

This document has no sections yet. Check back later or wait for the author to add content.