Secure Apex

Apex ProgrammingSecure ApexWrite Apex that respects the platform's security model: sharing keywords, user mode database operations, FLS and CRUD enforcement, injection and XSS prevention, secrets handling, guest-user and @AuraEnabled hardening, and automated scanning with Salesforce Code Analyzer.Advanced · about 80 minutesWhat you will learn

Explain system mode vs user mode and how API version 67.0 changed the defaults

Choose correctly between with sharing, without sharing and inherited sharing

Enforce CRUD, FLS and sharing with WITH USER_MODE, AccessLevel.USER_MODE, as user and Security.stripInaccessible

Prevent SOQL injection with bind variables, queryWithBinds and allowlists

Recognize and fix XSS, CSRF and open-redirect vulnerabilities in Visualforce, Aura and LWC

Protect secrets with Named Credentials, protected metadata and the Crypto class

Harden @AuraEnabled methods and guest-user code, and run Salesforce Code Analyzer security rules

Contents

Three layers of data security

Sharing keywords

Versioned behavior: API 66.0 and earlier vs 67.0 and later

User mode database operations

Security.stripInaccessible

Describe-based checks and WITH SECURITY_ENFORCED (legacy)

SOQL injection

Cross-site scripting (XSS)

CSRF and open redirects

Handling sensitive data

Special contexts

Automated scanning: Salesforce Code Analyzer

AppExchange security review checklist

Best practices

Common pitfalls

Hands-on exercises

Key takeaways