AppControl Docs
  • Introduction
  • Overview
    • Features
    • Product architecture
      • AppControl Repository
      • Policy Checks
    • Initial set up
      • AppControl User
      • Install package
      • Configure system
      • Add apps
      • Add users
      • Give permissions
    • User Roles & Access
    • Getting Started
      • Platform Administrator
      • App Owner
      • App Administrator
      • Developer
  • Dashboards
    • Platform
    • Alerts
    • App
      • Log Rule
    • Policies
      • Compare Revisions
    • Releases
      • Create Release
    • Tasks
      • Task Assignment
      • Task Details
    • Insights
      • Components
      • Reports
      • Users
      • Logs
  • Administration
    • Policies
    • Pipelines
      • Approval
      • Backup
      • Build
      • Call API
      • Check Policy
      • Deploy
      • Deploy Configuration
      • Notification
      • Start / Stop
    • Tasks
    • App Groups
    • Access Groups
    • System
      • Accounts
      • Notifications
      • System Status
      • System Logs & Tools
      • System Configuration
      • Repository
        • Log Solution
      • Product License
      • Management API
      • Mendix Configuration
    • Feedback
  • Checks
    • APIs
      • Published APIs must use authentication
    • App
      • Project security level
      • Project security enabled
      • Demo users enabled
      • Anonymous users enabled
      • Strong password policy
      • Default admin username changed
      • Anonymous user access restricted
      • Default admin user restricted
      • Use strong hash algorithm
      • Check user role security for consistency
      • Restrict users to a single session
      • Perform strict page URL checks
      • Project naming standards
    • Components
      • Components with vulnerabilities
      • Mendix runtime version age
      • Mendix runtime support status
      • Non platform supported components
      • Max component age
      • Average age components
      • Use latest version of Marketplace module
      • Use latest version of Marketplace widget
      • Use latest version of Mendix
      • Limit number of Java libraries
      • Limit number of widgets
      • Use minimum Mendix runtime version
    • Constants
      • Do not expose constants to client
    • Development
      • Last commit to production
      • Last commit to project
      • Project documentation standards
      • Project organization standards
      • Project logging standards
    • Domain Model
      • Default member access rights restricted
      • Use read only attributes in XPath constraints
      • Anonymous users can only change own data
      • Anonymous users cannot change unlimited length strings
      • Domain model standards
      • Anonymous user access restricted
      • Naming standards - Domain Model
      • Documentation standards - Domain Model
    • Enumerations
      • Naming Standards - Enumerations
    • Microflows
      • Incorrect date format
      • Incorrect empty string check
      • Empty variable used
      • Apply entity access when generating documents
      • Use inherited entities from System module
      • Web service calls with templates should be escaped
      • Naming Standards - Microflows
      • Logging Standards - Microflows
      • Documentation Standards - Microflows
    • Pages
      • Attributes in data views should be editable
      • Naming Standards - Page Flows
      • Documentation Standards - Pages
  • Support
    • Docs
    • Feedback
    • Tickets
    • Releases
    • System Status
    • User Details
Powered by GitBook
On this page
  1. Checks
  2. App

Demo users enabled

Check ID
APP_0003

Category

Security

Summary

Demo users is a feature in Mendix that will create test users for you automatically when you run your app (locally or in the cloud). Although this is a handy feature for quickly testing different user roles, it presents a possible security risk as the names of demo users are easy to guess and they bypass SSO. Demo users should never be enabled in an app deployed to production, and for maximum security it is recommended not to use this feature at all.

Options

This check does not have any options.

Pass

Demo users are disabled.

Fail

Demo users are enabled.

PreviousProject security enabledNextAnonymous users enabled

Last updated 11 months ago