When performing static or dynamic SOQL queries, should WITH SECURITY_ENFORCED now be replaced with WITH USER_MODE? Under what conditions, if any, should WITH SECURITY_ENFORCED still be used given there is also WITH SYSTEM_MODE?

If I attempt to replace SECURITY_ENFORCED with USER_MODE, the Salesforce Extensions in VSCode produce the warning:

Validate CRUD permission before SOQL/DML operation (rule: Security-ApexCRUDViolation)

Is this just a case of the VSCode Extension not being updated yet? (Or that USER_MODE is still in beta?)

The Apex Developer Guide talks about USER_MODE here:

Salesforce's dreamhouse-lwc sample application uses USER_MODE in at least one of their controllers.

  • Are you not getting the error if you have SECURITY_ENFORCED Commented Mar 21, 2023 at 7:25
  • VSCode presents an orange, underlined security warning when I use USER_MODE. It does not preset any security warnings when I use SECURITY_ENFORCED in the exact same places.
    – kennyc
    Commented Mar 21, 2023 at 17:11

1 Answer 1


We are recommending developers use WITH USER_MODE and avoid using the WITH SECURITY_ENFORCED

In fact, at some time in the future, we may likely retire WITH SECURITY_ENFORCED

The WITH USER_MODE supports lots of new innovations like restriction rules, scoping rules, and any other security operations for data access and CRUD/FLS that may be added by the platform in the future, so it's sort of future-proof. It also handles complex security use cases better.

Also, it supports SOSL and polymorphic queries and performs far better than using the WITH SECURITY_ENFORCED.

The WITH USER_MODE can handle CRUD/FLS for fields in where clause in SOQL or for areas used in relationship query or polymorphic lookup.

You can find more information about why you should prefer WITH USER_MODE and avoid WITH SECURITY_ENFORCED in the latest talk at TrailblazerDX 2023 conference, and the link to view the talk is shared below.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .