Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

Why am I able to see a lookup record's name field if I don't have access to the record

I have an Object A and that has a look up to an Object B. There is a record A1 in Object A and there is a record B1 in Object B. Record B1 is a lookup on A1. The user has access to record A1, but does ...
Sanch S.'s user avatar
0 votes
1 answer
28 views

How to hide EmailMessage from shared users?

Say I have an Account that I share with user A and B. If user A sends email message, I don't want user B to see it. So far I found Email Messages appear as Task object. TaskShare object doesn't seem ...
dzh's user avatar
  • 4,125
0 votes
0 answers
18 views

Domain Whitelisting AWS-based Appliciation in Hyperforce

Is there a way to whitelist a list of domains instead of IP Addresses in Salesforce after Hyperforce migration similar to allowlisting introduced here documentation but for incoming applications? We ...
SFDCKen's user avatar
  • 75
0 votes
1 answer
54 views

Manage package security review issue: Insecure Storage of Sensitive Data

My application is currently undergoing security review and has been reported with the 'Insecure Storage of Sensitive Data' issue, cause I'm storing the auth credentials in custom Object to enable ...
Mostafa Ghonem's user avatar
0 votes
1 answer
54 views

Using a Custom Object or Standard Object to expose data for integration

I have a requirement to integrate with a 3rd party application for Account data (Account creation). The idea is that Salesforce will be the primary source of truth and the other application will be ...
Minz's user avatar
  • 101
-2 votes
1 answer
89 views

how to secure sfmc cloud pages from external scripts attack?

When it comes to the security of the cloupages. How can we prevent the external scripts running on the cloud pages and secure our cloud pages from RXSS attacks on the smart capture form fields on the ...
Adam Coder's user avatar
1 vote
1 answer
76 views

How to establish API connection to a Trial Enterprise Edition org?

I have an enterprise edition free org. This has API access as I have connected to it over Postman via a connected app that I created. The problem I'm facing is that I want to connect to this org over ...
Apex Srinivas's user avatar
0 votes
1 answer
89 views

CSRF Fix not working in LWC

Below is a dummy LWC component to update a Custom Object record field (Year__c) value. Dummylwc.html <template> <lightning-modal-header label="ANTI-CSRF TEST COMPONENT"><...
Brav's user avatar
  • 820
0 votes
1 answer
51 views

Security review failed due to debug lines

So the salesforce security review of my mannaged package failed due to data in log lines they have stated the below: Issue Description Revealing information in debug statements can help reveal ...
ravent's user avatar
  • 35
-1 votes
1 answer
21 views

Can I restrict a user with Role 'A' to view cases only with the status (picklist) values : new and open

Case object : private owd Role :A User with Role A should only be able to see the cases with status picklist values: new and open. How can I do this? Is it even possible to restrict users access on ...
Jason David's user avatar
0 votes
1 answer
62 views

Question about Endpoint scanning (ZAP) for security review

As part of the Salesforce security review they state: If your solution connects to any non-Salesforce domains, also run Chimera, ZAP, or Burp Suite on the external endpoints. Include reports from your ...
ravent's user avatar
  • 35
0 votes
0 answers
39 views

OWD and Profile Security Settings

I am facing an issue. 2 Custom objects Job(master) and Candidate (child). Job - parent (OWD private) (Custom Profile permission - Read permission only) Candidate - Child (OWD Controlled by parent) (...
Rashmi Shankhpal's user avatar
1 vote
2 answers
168 views

LWC component throws error during loadScript for static resource - Lightning Web Security: Cannot access fullscreenEnabled

Have an LWC component that loads the @carbon/charts UMD bundle which is in force-app/main/default/staticresources/carboncharts. The renderedCallback() is throwing this error: [Lightning Web Security: ...
nstuyvesant's user avatar
0 votes
0 answers
39 views

OWD vs Role hierarchy on Activities

I have a problem with setting up data security as per client's needs. What I want is for any user to have access to any Task regardless they are the owner or not of the task or the account or contact (...
Simona Croitoru's user avatar
0 votes
1 answer
16 views

Is there are way to split users permissions between

Is this possible to control which users have access to which dialogs in one Einstein Bot? Is this possible to control which users have access to which bots? This article https://help.salesforce.com/s/...
Patlatus's user avatar
  • 17.1k
2 votes
1 answer
211 views

SOQL query 'WITH USER_MODE' then update

I fetch ObjectA records with a SOQL query 'WITH USER_MODE'. Then I modify those records and want to update them in user mode I am not sure if the previous 'WITH USER_MODE' command is enough to prevent ...
Bob Bob's user avatar
  • 21
0 votes
0 answers
49 views

How to Create/Insert a new record of the objects AccountAccountRelation and PartyRoleRelation?

these 2 objects AccountAccountRelation and PartyRoleRelation have been added to our project recently and I don't know why I cannot create a record of these objects. When I want to set the value of a ...
Gnopor's user avatar
  • 151
0 votes
0 answers
22 views

Site.login method invalid password issue

I have to develop custom login page in a LWR community. I configured maximum wrong login attempts number in the Customer Profile, but I've recently found that Site.login does not increase number of ...
Vladimir Egikyan's user avatar
0 votes
1 answer
48 views

I want control the visiblity of record by Apex Manage sharing

I am trying to implement a solution of Account and contact, I have custom field Account status (Picklist field) values - Open, Close My condition is when the Account status is moved to "Open&...
Puja's user avatar
  • 13
1 vote
2 answers
144 views

Apex Security in Salesforce

I have a question regarding Apex class security. I am new to coding so have some questions. My question : Whats the importance of using 'Enabled Apex Class Access' option through profile or class list?...
Abha Khanna's user avatar
2 votes
1 answer
76 views

Storing Sensitive Information in ISV App

In our managed package, we have a lightning page where the app admin can set a couple of settings related to the app, including an API key to interact with 3rd party system, and all this information ...
Hasan Tokul's user avatar
-1 votes
1 answer
29 views

Is it a security vulnerabity to pass all field values of a record to a user

I created a Apex class that returns every field of a context record into any flow. The program works with any sObject. Are there any security vulnerabilities by doing this? Should I prevent fields ...
Mike's user avatar
  • 23
1 vote
1 answer
261 views

How to restrict users accessing the Custom Metadata Type Record?

We are building a application which required a Public Custom Metadata Type. We have a Screen flow which has an LWC Component which calls an Aura Enabled Method of a public with sharing class. In this ...
S1th's user avatar
  • 143
0 votes
0 answers
36 views

Security Issue While Rendering Rich Text in Visualforce Page [duplicate]

I am trying to render a rich text content in a Visualforce Page like so : <apex:outputText styleClass="richText" value="{!richTextContent}" escape="false"/> ...
Hasan Tokul's user avatar
2 votes
1 answer
102 views

What is the meaning of Type field on PermissionSet standard object in Salesforce?

Documentation page about permission set provides a limited information about Type field. Type: reference Properties: Filter, Group, Nillable, Sort Description: Available in API version 46.0 and later....
Patlatus's user avatar
  • 17.1k
1 vote
1 answer
167 views

SSO using SAML - Error using Heroku App setting Up SAML

I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5 I setup SSO ...
SfdcBat's user avatar
  • 4,811
0 votes
1 answer
308 views

How does the CampaignMember object work in terms of record visibility?

I am trying to understand how the CampaignMember object behaves in terms of security. According to the Salesforce documentation, in order for a user to view a CampaignMember record the user must have ...
Tzinm's user avatar
  • 21
2 votes
0 answers
119 views

How does Permission Sets works against Licenses of Managed Package

We have built a Second Generation Managed Package and want it to be available as paid version in AppExchange Portal. So If a user buys it from AppExchange, he/she gets the licenses to use the solution....
S1th's user avatar
  • 143
1 vote
1 answer
892 views

Why is OAuth Client Credentials safer than OAuth Username-Password?

According to Salesforce, here "You can use the username-password flow to authorize a client via a connected app that already has the user’s credentials. However, we recommend avoiding this flow ...
Morgan Marchese's user avatar
3 votes
1 answer
128 views

Enforce User Mode in Dynamic SOQL - String or Parameter?

Is it equally appropriate and safe to use each of those Dynamic SOQL calls with USER MODE or should I prepare one over the other? The official documentation doesn't make that clear. User Mode as part ...
Robert Sösemann's user avatar
-1 votes
1 answer
413 views

Does 'View all data' permission in salesforce give users access to private reports of another user? [closed]

Does 'View all data' permission in salesforce give users access to private reports of another user? Couldn't find any exact theory on this.
Vats Mittal's user avatar
1 vote
1 answer
579 views

How to Resolve the Apex PMD Rule "ApexOpenRedirect"

community. I am currently working on a custom plugin for an Auth Provider in Apex and have encountered the error message "Apex classes should safely redirect to a known location (rule: Security-...
Josue0117's user avatar
0 votes
1 answer
131 views

Lookup query exception while using USER_MODE

I am trying to create a 2GP package. But whenever I try to create a version by running and validating all test classes and metadata, the test class fails and shows such an error. "common.apex....
AJITHKUMAR VP's user avatar
-1 votes
1 answer
59 views

Perform DML on Salesforce Object from non-salesforce user

I have a requirement to send an email to individuals who are neither Salesforce users nor community users. Within the email, there is a hyperlink, and when they click on it, I need to update the ...
Amol Girme's user avatar
0 votes
0 answers
117 views

Callout named credential calls with a blob body

I am trying to launch a callout call to an OCR from an Apex method using a secured named credential with an external credential. The HTTP request is a POST request with multipart body containing a ...
Diaboloxx's user avatar
  • 101
0 votes
1 answer
507 views

Programmatically edit authentication parameter of external credentials

I was wondering if updating an authentication parameter of an External Credential was possible from an Apex method. The main goal of this function would be to programmatically store an access token ...
Diaboloxx's user avatar
  • 101
2 votes
1 answer
167 views

Best Practices for CRUD/FLS/SHARING checks in unmanaged code

I'm auditing an ORGS unmanaged Apex and trying to form a concrete framework for when I care about PMD warning for ApexCRUDViolation & ApexSharingViolations. It's always been my understanding that ...
NSjonas's user avatar
  • 10.2k
-1 votes
1 answer
146 views

Check if user have set security Question

Is there a soql that system admin can execute to list users who have set security question during their past logins? Thanks,
MBM's user avatar
  • 129
-1 votes
1 answer
84 views

How to make an attached document to record visible only for the owner

How to make an attached document to record visible only for the owner of record (custom object) and not visible for other users (for wish record is visible)?
Pedro Van's user avatar
0 votes
1 answer
94 views

Do I need to check FLS for each field when creating a new object record in apex?

If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
lhh13's user avatar
  • 41
0 votes
1 answer
28 views

How to detect Formula Expressions exposing vulnerable information like session id?

There is a snippet from the Salesforce Security Guide (Version 58.0) Formula Tag heading explaining why it is a security vulnerability : The general syntax of these tags is:{!FUNCTION()} or {!$OBJECT....
compski's user avatar
  • 1,352
-1 votes
1 answer
470 views

Is WAF implemented for Salesforce APIs?

Our client's cybersecurity team is inquiring if Salesforce implements WAF (web application firewall) for its standard APIs. We have a salesforce application using Sales, Service and Experience cloud. ...
Shamina's user avatar
  • 4,275
0 votes
1 answer
68 views

Validate OWD, with sharing, Profile, Permission Sets as Non - ADMIN user

I am trying to validate the OWD for an object that is Public/Read Write without Read permission at the object level for a specific profile user. To validate the results I created a new profile by ...
indrasen neelam's user avatar
2 votes
2 answers
233 views

Insecure Storage of Sensitive Data Vulnerability for a security review

We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ". I am making a call to external service to get a encrypted claim that i am using to ...
Manjot Singh's user avatar
  • 3,516
0 votes
0 answers
100 views

Check whether generic SObject is updateable

How do I check whether a generic SObject is updateable before DML operation. For standard and custom objects I know the general pattern is: Schema.sObjectType.Account.isUpdateable() However if I have ...
lhh13's user avatar
  • 41
1 vote
1 answer
644 views

Restrict access to specific fields when using Salesforce Integration User Licence on Standard objects (like Contacts)

By default, the Salesforce Integration User Licence doesn't provide access to a variety of standard objects (including Contacts and Accounts). You can extend the access for an integration to those ...
Nathan McQueen's user avatar
-1 votes
2 answers
102 views

Data segregation for high confidentiality

I work at a bank and we currently use one single org to simplify our processes, but we have a department with highly confidential info. I’m trying to find a way to “separate” the data from this ...
Luis Bazzoli's user avatar
0 votes
0 answers
328 views

Only Create Access but edit and delete using permission set

I have an requirement that profile need to give creating the record but delete and edit access should be done by permission set. In profile on FLS I gave read and edit acccess to all field or else we ...
Arjun's user avatar
  • 3
0 votes
0 answers
1k views

Able to view the Account records even though OWD set to private and removed all permissions like view all & modify all

I have created the sharing rule to share ony specific record type record to shared with a group. my object is Account and Org-Wide Defaults set to the Private, removed the permissions like view all &...
BRAHMA REDDY's user avatar
0 votes
0 answers
58 views

Granting Access to a Managed Package

We are developing a managed package that will be published. We want to control access to our application based on user LICENSE. However, we are unsure about the most effective method to achieve this. ...
APEX PREDATOR 3000's user avatar

1
2 3 4 5
19