I have a basic visualforce page that uses the standard controller for an object (Custom_Object__c). The object is a detail record, with the master being another custom object (Parent_Object__c).
The page simply shows a handful of read-only fields. The page is exposed via a Force.com site.
This is working fine in the sandbox. But in production, the page is logging this error: System.VisualforceException: Read access denied for Custom_Object__c, controller action methods may not execute
I've given the site Guest user Read access to both the child and parent object. I've also created a sharing rule that gives the Guest read-only access to all parent objects, just in case. But no luck. I've also confirmed that the visualforce page has been added as an authorized page in the Site settings.
Normally, I'd assume the Guest user can't use a standard controller after the Summer 20 security changes. But if so, why would this be working fine in the sandbox?
I'm currently comparing security settings between the sandbox and production. I see that "Secure guest user record access" is checked in both environments. Any other ideas?