Tag
Security
5 articles
Dynamic SOQL Done Safely
Dynamic SOQL fails more AppExchange security reviews than almost anything. Here's how I build queries that can't be injected — binds, allowlists, user mode.
CRUD/FLS Enforcement: Why Most Apex Code Fails Security Review
The CRUD and FLS enforcement patterns that actually pass AppExchange security review — and the antipatterns the scanner keeps flagging.
Sharing Rules vs Manual Sharing vs Apex Sharing: When to Use What
Sharing rules, manual sharing, or Apex managed sharing? After years spent untangling Salesforce security models, here's how I decide which one to reach for.
Permission Set Groups: The Pattern That Simplifies Everything
Assigning permission sets one by one turns into sprawl nobody can audit. Here's how I use permission set groups and muting sets to make access legible again.
Moving from Profiles to Permission Sets (Without Losing Your Mind)
Salesforce has been nudging us toward permission sets for years. Here's how I actually did the migration on a large government org — the strategy, the gotchas, and what I'd do differently.