> For the complete documentation index, see [llms.txt](https://docs.eximee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.eximee.com/documentation/documentation-en/budowanie-aplikacji/logika-biznesowa/scriptcode/dobre-praktyki-scriptcode.md). # ScriptCode best practices ### Context The rules for writing ScriptCode on the Eximee platform will help ensure consistency, readability, and code safety, as well as make onboarding new employees easier. Create ScriptCode according to the rules described below.
AreaRule
Consistent naming convention
  • Write code in English - use English names for variables, functions, etc.

Exceptions: top-down business agreements regarding naming or a high level of script complexity (here the decision is up to the low-code developer). If you decide to use a Polish naming convention - be consistent within a single script.

  • Literal constants hardcoded in code, name them in UPPER_SNAKE_CASE format, e.g. const MOBILE_CHANNEL = "mobile"
  • Name other variables and functions in camelCase format, e.g. const correlationId = context.getFirstParameter('correlationId'), let motherBranchNumber, function generateBranch()
Order in code structure

Organize code in the following order:

  1. Literal constants- declare at the beginning of the script
  2. Variables - then declare variables that will be used in the main logic
  3. Main logic - the main sequence of operations performed by the code (e.g. data processing, calling functions)
  4. Helper functions - place at the end
Logging
  • Do not duplicate platform logs - if any parameters are automatically generated by the platform, do not log them again in the script
  • Use the sensitive logger to log sensitive data, pattern: Logger.info("Client's PESEL filled in on the form: {}", pesel)

Learn more:
Logging in ScriptCode

Variable declaration
  • Do not use var
  • Primitive types: use let only when you change a variable's value in the script. In other cases, use const
  • Composite types: do not use let if you only modify the contents of an object - including arrays (Array), sets (Set), maps (Map).

There is no need to use let when declaring objects - including arrays (Array), sets (Set), maps (Map) - as long as the reference (i.e. the reference to a specific object or array) will not be changed.
In most cases, const should be used to declare arrays and other objects, even if their contents will be modified.

Example using const:

const array = [1, 2, 3];
array.push(4); // Works correctly, we modify the array contents

const obj = { name: "Alice" };
obj.age = 30; // Works correctly, we modify the object's properties

Note: As long as the Rhino engine does not properly support block scope for const, variables inside a "for" loop should be declared using let. More about the bug can be read in the material linked below.

Learn more:
Data types in Javascript,

Reference, mutability, primitive types - Javascript refresher!

Scripts(ScriptService)

Table listing which functionalities are currently not properly supported by the Rhino engine
Rhino: error when declaring const inside a for loop

Error handling
  • Use blocks try-catch in places where exceptions may occur. If an error occurs, log it using the logger to enable easy tracking of the problem.
Code readability
  • Right-click → select Format Document. This will make the code more clear and readable
  • Remove code that is commented out and no longer needed
  • Write comments concisely and clearly, explaining more difficult parts of the code, intentions, and unusual solutions. Avoid obvious comments that merely repeat what is already readable in the code.
Code repetition
  • If you repeat a code fragment several times - create a helper function
Script description
  • When creating a new script/validator - add a description
Tests
  • Create unit tests whenever possible, include edge cases.
Security
  • Treat any parameters entering ScriptCode as untrusted when sending to services

Sample code:

Bad:

Good:

  • Do not use authorization data directly in ScriptCode
  • Fetch remote resources (images, documents, card images, etc.) from a trusted source (e.g. the Eximee platform, a bank resource)
  • If you must use any link in the application, make sure it is trusted and its use follows directly from the requirements
  • If a functionality is not available on the platform, submit a request - do not use external tools

Learn more: OWASP Application Security Verification Standard 4.0 - scriptCode

Mathematical operations with BigDecimal
  • Perform mathematical operations using BigDecimal

Learn more: Mathematical operations in ScriptCode

Handling falsy values
  • Before using properties or methods, check whether the variable's value is not null nor undefined, to prevent errors related to missing values. In situations where you want to catch also 0, empty string or NaN, you can use a general condition if(value).
Review
  • If you are not the only low-code developer on the team - ask someone from the team to review the code.
### Materials * [OWASP Application Security Verification Standard 4.0 - scriptCode](/documentation/documentation-en/budowanie-aplikacji/logika-biznesowa/scriptcode/dobre-praktyki-scriptcode/owasp_application_security_verification_standard_4.0-scriptcode.md) * [Mathematical operations in ScriptCode](/documentation/documentation-en/budowanie-aplikacji/logika-biznesowa/scriptcode/skrypty-scriptservice/api-skryptow/operacje-matematyczne-w-scriptcode.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.eximee.com/documentation/documentation-en/budowanie-aplikacji/logika-biznesowa/scriptcode/dobre-praktyki-scriptcode.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.