Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review.
(Though this looks Manage DML Exceptions in User-Mode Database Operations problematic but fixed in Summer '23?)
Anyone passed a security review using this approach?
PS
Evolution of security described in detail in this 30 min presentation:
Anyone passed a security review using this approach?
That should almost certainly be a "yes." Salesforce.com has been committed to making the ISV experience as easy as possible. Salesforce DX, improved security models for Apex Code, Scratch Orgs, and so on, are all meant to make it easier to get to market faster. Salesforce.com's success depends, in part, on how successful their partners are, and they take this seriously. Whenever you see a new feature that looks like it'd make your job as an ISV easier, that's because it is a new feature that is designed to make your job as an ISV easier.
These new security enhancements are not built in a silo. Salesforce.com coordinates the new features with the Partner Support team and partners that provide code scanning tools, in order to make it easier to get all the way through the process when you decide to use the new features. In the ordinary sense, salesforce.com wouldn't give you a shiny new security enforcement tool, then tell you that you can't use it. And yes, as you've noted, sometimes bugs happen, but overall, if you're an ISV, these are the tools you've been asking for.
