Strict Mode

Last modified: October 16, 2026

Introduction

Configuring access rules is essential for the security of your app. However, accurately setting up these rules can be challenging. In case you make any mistakes setting up access rules, you want a safety net when you roll your app out to users.

Strict Mode strengthens application security by restricting certain client APIs and ensuring that data access follows the pages, widgets, microflows, and nanoflows defined in your model. This makes automated attacks and scripted access attempts significantly harder, while helping to reduce unintended data exposure caused by security misconfigurations.

Employing strict mode can be a major differentiator for app safety. Strict mode is set up in keeping with the guidelines outlined in the OWASP Low-Code/No-Code Top 10, addressing LCNC-SEC-05: Security Misconfiguration.

Please note, strict mode is exclusively available for the React client.

Enabling Strict Mode

Strict mode can be enabled in App Security when the React client is enabled and the security level is set to Production.

Restricted Client APIs

When strict mode is enabled, the following client APIs will be restricted:

API	API exceptions
data.action
data.create
data.commit
data.remove
data.rollback
data.get	The following APIs are not restricted: GUID and GUIDs

The APIs will be disabled on the Runtime, which means that these APIs cannot be invoked in online apps via JavaScript actions or the browser's console. If any of these APIs are used in a JavaScript action, consider using a nanoflow instead.

Restricted Client APIs in Platform Supported Widgets

In strict mode, some actions in platform-supported widgets are restricted because they rely on blocked client APIs.

File Uploader – The delete action does not work in strict mode because it uses data.remove. To work around this restriction, create a custom button and use a nanoflow to delete the file object. For guidance, see the Enable Custom Buttons section in File Uploader.
Web Actions – The Take picture action does not work in strict mode because it uses data.commit to create the object.

Save And Cancel Changes Action

In strict mode, your model is analyzed by Studio Pro to ensure that only entities within editable widgets can be saved or rolled back during save or cancel actions.

Additionally, since Save Changes Actions and Cancel Changes Actions are not analyzed for layouts, placing a save or cancel button within a layout triggers a consistency error. Instead, these actions can be used within a snippet.