I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk:

enter image description here

You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code is isCreateable() which I believe is correct as it compiles perfectly well and it is also documented here: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm

Here is my Apex code for reference:

if (Schema.sObjectType.Log__c.isCreateable()) {
  insert logEntry;

Does this need to be documented as a false positive?


You must log in to answer this question.