Just went through Security Requirements Checklist (https://developer.salesforce.com/page/Requirements_Checklist) in order to verify things that could be detected as a vulnerability in our app for security review. One of the checklist items mentions "Shield: Enforce encryption model" (https://developer.salesforce.com/page/Enforcing_Encryption), however, it looks like the permission/masking related was deprecated in Winter/Spring '17:

https://help.salesforce.com/articleView?id=000247422&type=1 https://releasenotes.docs.salesforce.com/en-us/spring17/release-notes/rn_security_pe_masking.htm https://releasenotes.docs.salesforce.com/en-us/winter17/release-notes/rn_security_pe_ved_decouple_announcement.htm

So the question we have is, is this encryption enforcement still valid as checklist item for security review? Did anyone who already passed security review successfully had some observations related to this?

The reason we ask, mainly, is because we figured out that we cannot test this fix since even setting up "View Encrypted Data" permission to unchecked for a certain user/profile, data seems to be unmasked anyway, which would make sense with article/release note for winter'17.


Thank you for raising this, really appreciated. I will follow up with our doc writer, masking does not apply to Shield anymore

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.