We have a Salesforce public site where we expose name fields of Account and Contact object. These fields are queried through a lookup of Account and Contact on a custom object. Like this:
[Select Id, Account__c, Account__r.name, Contact__c, Contact__r.name from Custom_Object__c]
For this query we applied Read access on Account(Name), Contact(FirstName, LastName) and Custom Object.
Problem is client can not provide Read access on Account and Contact object to guest user, it is too much of access. Other option is to remove Read access checks from Account/Contact object and from Name field of them but will it create issue during Salesforce security review?
In general, Is it okay if we just check the read permission on lookup field on custom object and remove the access checks from fields which are referred through that lookup.
What are other alternatives?