TOFfe Dev Tools Edge extension security report

TOFfe Dev Tools is a workbench for Mendix consultants, developers and UX/UI designers, built by The Orange Force. Open it on a deployed Mendix app you are authorised to work on — no Studio Pro, no source access — and see what is really running: • OVERVIEW — a one-screen app review: session, domain model, Web Vitals, traffic and errors, accessibility and access, with attention points, an HTML report and a support-bundle export. • DATA — query and (optionally) edit entity records through the Mendix client API, always with the exact permissions of the logged-in user; the entity model with the read/create/write access matrix per user role; live client memory including uncommitted changes; and a relations explorer to walk associations from any record. • SECURITY — surfaces common Mendix configuration mistakes a developer can fix, each mapped to a public standard (OWASP, OWASP Low-Code Top 10, the S-Unit Top 10): over-broad entity access, secrets in client constants or browser storage, sensitive fields on published services, exposed service documentation, an end-of-life runtime, missing security headers, and more. Observed read-only, as your own session. • MICROFLOWS & PAGES — discover and test-run microflows with typed inputs, compare results in a run console with object diff and history, and open pages directly. • NETWORK & CONSOLE — the app's runtime traffic decoded and readable: per-operation totals, timings, N+1 detection, Web Vitals, request replay and the console. • API — discover and try the app's published REST, OData and SOAP services. • DESIGN — a designer-grade toolset: element inspector with WCAG/APCA contrast, page-wide contrast scan, accessibility audit with a client-ready report, design-token analysis (hardcoded values, !important, unused/undeclared variables), CSS cascade with file:line source locations, inline-styling detection, HTML viewer, freeze tool, colour-vision simulation, tab-order overlay and a live theme playground. Everything is bilingual (English/Dutch), reachable via a command palette, and the panel docks in the page or moves to its own window. The tool works strictly within the session of the logged-in user: it can only see and do what that user can, on the app's own origin. Server-side security always applies. Writes are off by default and confirm-gated. Nothing is collected or transmitted — no telemetry, no external servers. See the privacy policy for details. Intended for teams inspecting applications they build or maintain. The responsible-use note in the tool itself applies. TOFfe Dev Tools is an independent tool by The Orange Force and is not affiliated with, endorsed by, or sponsored by Mendix. "Mendix" is used only to describe what the tool inspects.