Is there any issue with having your organization ID and your production ID seen in links?

I am having to upload image files as Documents into my salesforce org and then send the image through visualforce emails. According to this link: Why images stored as static resources cannot be seen in emails sent using VF email templates? I need to upload images and then input my org and instance links into the files. Is there any security issues with exposing this information?

E.g. - the doc states you put images in VF emails like this:

<apex:image id="Image" value="https://***yourInstance***.salesforce.com/servlet/servlet.ImageServer
 height="64" width="64"/>
  • 4
    I've seen posts in the past, relating to web-to-lead, saying avoid it where possible as it can be used to spam the org. For example success.salesforce.com/ideaView?id=08730000000Bq20AAC and success.salesforce.com/ideaView?id=08730000000l61UAAQ
    – Girbot
    Commented Sep 26, 2016 at 18:24
  • I'm not sure if you can hide that org ID easily so if Salesforce can change that, it will be greatly beneficial!
    – akcorp2003
    Commented Sep 26, 2016 at 18:41
  • 1
    the webtolead and webtocase examples cited by Girbot are subject to page scrapers. In your example, you are sending emails so unless those emails are ending up searchable by spammers, your risk is somewhat mitigated. Nevertheless, this is a good question. I would imagine that given SFDC already offers W2L and W2C with exposed orgId, this additional exposure qualifies as 'working as designed'
    – cropredy
    Commented Oct 2, 2016 at 22:45


You must log in to answer this question.

Browse other questions tagged .