I am about send my package for Security Scanner, So Is there any requirement to add "with Sharing" for all of my Batch Classes.

global with sharing myBatch implement Database.Batachable<sObject> {}


global myBatch implement Database.Batachable<sObject> {}

this will not cause any scanner isuue ?

  • 1
    Do you need this class to be global? I ask because many of the examples still (for historic reasons) have global in them, where using the public access modifier will work just fine and thus your class will not be subject to the eyes of the security scanner. If you don't need your subscriber org developers to see this class, easiest option is just to make it a public class. – Andrew Fawcett Jul 17 '14 at 7:32

I have just submitted a security scanner and did not add with sharing to my batch classes. The scanner did not complain. However it is allowable to have a class that is without sharing that pops up a red flag in the scanner and for the Security Review team to let it pass if you can justify why you have done it and that you are not just ignoring sharing rules but bypassing them for a valid reason

| improve this answer | |
  • Batch classes are often used for housekeeping and therefore need to run without sharing. However, if the batch processes user-facing data, such as a batch data export, then it may be recommended. – sfdcfox Jul 17 '14 at 14:54

First, please do not use the 'global' keyword here, unless you are really building an extension package and want this class to be exportable.

In the current ruleset, the scanner will not flag this issue (but this will change in future queries). Nevertheless this will raise flags in the security review.

Batch classes are not exempt from sharing requirements at all. If you think about it, running asynchronously or synchronously doesn't have anything to do with whether an organization's security policies can be ignored or not. This is a business logic question not a performance/governor limit question.

This does not mean that all batch classes must have sharing, only that the sharing requirements are exactly the same for synchronous and asynchronous apex: all entry points to the app, especially global classes, must have the 'with sharing' keyword without exception. To perform a privileged operation in an entry point, put it in a helper class that is marked 'without sharing'. If there is a business reason to have the class run without sharing, then document the reason. In all cases, try to adhere to the principle of least surprise.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.