From 0d4bdb0b97894d912f763afbf819649efd6180ce Mon Sep 17 00:00:00 2001 From: Alisa Frelia <1579593+exec-astraea@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:06:39 +0200 Subject: [PATCH] Improved Strict Mode doc --- .../refguide/modeling/security/app-security/strict-mode.md | 4 ++-- .../refguide10/modeling/security/app-security/strict-mode.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/refguide/modeling/security/app-security/strict-mode.md b/content/en/docs/refguide/modeling/security/app-security/strict-mode.md index 96e90fe5fd9..31fc3785010 100644 --- a/content/en/docs/refguide/modeling/security/app-security/strict-mode.md +++ b/content/en/docs/refguide/modeling/security/app-security/strict-mode.md @@ -6,9 +6,9 @@ weight: 50 ## Introduction -Configuring [access rules](/refguide/access-rules/) is essential for the security of your app. However, accurately setting up these rules can be challenging. In case you make any mistakes setting up access rules, you want a safety net when you roll your app out to users. To make your app more secure in cases where access rules are not configured correctly, you can enable strict mode. +Configuring [access rules](/refguide/access-rules/) is essential for the security of your app. However, accurately setting up these rules can be challenging. In case you make any mistakes setting up access rules, you want a safety net when you roll your app out to users. -Strict mode will help ensure that entities are accessible only in the ways defined within your model – through microflows, nanoflows, widgets, or pages – by restricting certain client APIs. +Strict Mode strengthens application security by restricting certain client APIs and ensuring that data access follows the pages, widgets, microflows, and nanoflows defined in your model. This makes automated attacks and scripted access attempts significantly harder, while helping to reduce unintended data exposure caused by security misconfigurations. Employing strict mode can be a major differentiator for app safety. Strict mode is set up in keeping with the guidelines outlined in the *OWASP Low-Code/No-Code Top 10*, addressing [LCNC-SEC-05: Security Misconfiguration](https://owasp.org/www-project-top-10-low-code-no-code-security-risks/content/2022/en/LCNC-SEC-05-Security-Misconfiguration). diff --git a/content/en/docs/refguide10/modeling/security/app-security/strict-mode.md b/content/en/docs/refguide10/modeling/security/app-security/strict-mode.md index 9c0563f1ca3..4520eb8e384 100644 --- a/content/en/docs/refguide10/modeling/security/app-security/strict-mode.md +++ b/content/en/docs/refguide10/modeling/security/app-security/strict-mode.md @@ -6,9 +6,9 @@ weight: 50 ## Introduction -Configuring [access rules](/refguide10/access-rules/) is essential for the security of your app. However, accurately setting up these rules can be challenging. In case you make any mistakes setting up access rules, you want a safety net when you roll your app out to users. To make your app more secure in cases where access rules are not configured correctly, you can enable strict mode. +Configuring [access rules](/refguide10/access-rules/) is essential for the security of your app. However, accurately setting up these rules can be challenging. In case you make any mistakes setting up access rules, you want a safety net when you roll your app out to users. -Strict mode will help ensure that entities are accessible only in the ways defined within your model – through microflows, nanoflows, widgets, or pages – by restricting certain client APIs. +Strict Mode strengthens application security by restricting certain client APIs and ensuring that data access follows the pages, widgets, microflows, and nanoflows defined in your model. This makes automated attacks and scripted access attempts significantly harder, while helping to reduce unintended data exposure caused by security misconfigurations. Employing strict mode can be a major differentiator for app safety. Strict mode is set up in keeping with the guidelines outlined in the *OWASP Low-Code/No-Code Top 10*, addressing [LCNC-SEC-05: Security Misconfiguration](https://owasp.org/www-project-top-10-low-code-no-code-security-risks/content/2022/en/LCNC-SEC-05-Security-Misconfiguration).