1

This might be a silly question, but don't want to get caught under security review.

I have three questions/confirmations related to the security review

  1. FLS/CRUD Check Needed while publishing platform event? enter image description here
  2. FLS/CRUD Check Needed while Deploying Metadata? enter image description here
  3. FLS/CRUD Check Needed for Custom Setting getInstance enter image description here We have checked CRUD/FLS for custom setting when we queried

At the end of the day, we couldn't able to provide FLS/CRUD permissions for custom meta data and platform event. As long as salesforce is taking care of the dmls, do we need to check any CRUD/FLS or should we provide false positive stating these?

What would be the expert recommended solution on the above, any suggestions would be much appreciated

Improve this question
1
  • All I can say is that we don't check CRUD/FLS on Platform Events (can you even do so?!) and certainly didn't list this as a false positive, and passed our review. The same applies to our Custom Settings. For deploying metadata, we only do that during install for upgrade cases, so that doesn't count and I can't really comment.
    – Phil W
    Jul 6, 2021 at 15:47

0

Reset to default

You must log in to answer this question.