4 votes
Accepted

Security review failed due to debug lines

Record IDs are not keys. PII are things like names, email addresses, phone numbers, and so on. Technically a User ID isn't PII, nor are they keys. However, I feel like you're focused in the wrong ...
sfdcfox's user avatar
  • 487k
3 votes

SOQL query 'WITH USER_MODE' then update

WITH USER_MODE in a SOQL query just checks for read permission on the object and fields. To check for edit permission when updating, you will indeed need to use update as user.
fred's user avatar
  • 3,165
1 vote
Accepted

CSRF Fix not working in LWC

This isn't CSRF. Burp Repeater is software that intercepts network traffic at the device level. A compromised machine is required to make this attack feasible, such as a virus or browser extension ...
sfdcfox's user avatar
  • 487k
1 vote
Accepted

LWC component throws error during loadScript for static resource - Lightning Web Security: Cannot access fullscreenEnabled

This is a security feature, as outlined in the LWS Distortion Viewer. Basically, to make sure their customers are safe from phishing attacks, salesforce.com has blocked this feature entirely. Note ...
sfdcfox's user avatar
  • 487k
1 vote

Best practice for establishing Salesforce as a public and secure webhook endpoint target?

Everything you listed using the REST resource annotation and the request context looks good, and you can still secure it. Here are some tips specifically for HouseCall Pro webhooks: Store all webhook ...
Matt and Neil's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible