We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application".
An example provided is shown below in a "with sharing" class:
myAttachments = [SELECT name, id, parentid, CreatedDate,CreatedById FROM Attachment WHERE parentid=:myAccount.id];
If the user does not have access to the object or the field, the result will be null. So the FLS must be enforced.
The documentation here does not specify the issue. How can we resolve this issue?