Mendix uses QSM (Quality and Security Management) for performing security and quality analysis scans on applications developed with Mendix. It is specifically designed to work with the Mendix low-code model rather than traditional source code.

• Integration with the Mendix platform: QSM can be integrated directly with the Mendix platform. There is no need to manually export metadata, Java bytecode, or other artifacts to perform the analysis offline. 
• Note on traditional scanning tools: Standard source code scanners may not be directly applicable to Mendix applications due to the low-code nature of the platform. It is recommended to use tools that are aware of the Mendix model structure, such as QSM.