App Security in Mendix is the part of the platform where developers define user roles, module roles, and permission settings. It is the main place to control who can read, create, update, or delete data, and which application functions each role can use.
This matters because secure applications depend on correct authorization, not just secure code. If permissions are set too broadly, attackers or untrusted users may reach data and actions they should never see. In Mendix, App Security is especially important for managing access to entities such as System.User, where platform-enforced behavior can override assumptions made in entity-level rules. Defenders should use App Security to verify role design, test anonymous and low-privilege access, and confirm that real runtime behavior matches the intended model.