I have completed a review of the following aspects of our organization

a) Authentication

b) Verifying profile based permissions are inline

c) IP restrictions

d) Timeout on unattended sessions

e) Code review using the scanner

f) Logon history and identifying old browsers

g) Verified the config change was not done by non-auth users via "View Setup Audit Trail"

h) Verified there are no licenses being wasted on ex-users (sadly this is not done before)

i) Authorization check in the form of who has "view all" & "modify all" on which objects etc

Are there any other places that I should be checking further to seek for vulnerabilities ?

Would appreciate any pointers.

  • 2 cents from me,help.salesforce.com/apex/… make sure manage permission and profiles is disabled. I once had an issue where a user had this flag enabled and he was able to edit his profile and assign modify all data. Fortunate for us he did not know he could login as another user
    – Rao
    Nov 3, 2015 at 23:00

1 Answer 1


This is a good resource for checking security vulnerabilities. http://security.force.com/security/tools/forcecom/assessment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .