Just went through Security Requirements Checklist (https://developer.salesforce.com/page/Requirements_Checklist) in order to verify things that could be detected as a vulnerability in our app for security review. One of the checklist items mentions "Shield: Enforce encryption model" (https://developer.salesforce.com/page/Enforcing_Encryption), however, it looks like the permission/masking related was deprecated in Winter/Spring '17:
https://help.salesforce.com/articleView?id=000247422&type=1 https://releasenotes.docs.salesforce.com/en-us/spring17/release-notes/rn_security_pe_masking.htm https://releasenotes.docs.salesforce.com/en-us/winter17/release-notes/rn_security_pe_ved_decouple_announcement.htm
So the question we have is, is this encryption enforcement still valid as checklist item for security review? Did anyone who already passed security review successfully had some observations related to this?
The reason we ask, mainly, is because we figured out that we cannot test this fix since even setting up "View Encrypted Data" permission to unchecked for a certain user/profile, data seems to be unmasked anyway, which would make sense with article/release note for winter'17.
