salesforce-apex-quality

Never place SOQL queries or DML statements inside for loops. Instead, collect record IDs into a Set, query once before the loop using an IN clause, and perform a single DML operation after the loop on the collected records.

Use WITH USER_MODE in SOQL queries (API 56.0+), pass AccessLevel.USER_MODE to Database.query, or check Schema.sObjectType field accessibility before reading fields. Any method callable from UI components, REST endpoints, or InvocableMethod must enforce these checks.

Use 'with sharing' as the default for service, handler, selector, and controller classes. Use 'without sharing' only for elevated system operations with a documented reason, and 'inherited sharing' for framework entry points that respect the caller's context.

Always use bind variables (:variableName) instead of concatenating user input into query strings. For dynamic SOQL with user-controlled field names, validate the input against a whitelist of allowed fields before executing the query.

PNB stands for Positive, Negative, and Bulk testing. Every feature needs tests for expected inputs, error conditions with proper exception assertions, and bulk operations processing 200-251 records in a single transaction using Test.startTest and Test.stopTest.

Trigger bodies should only contain context checks, handler invocation, and routing logic. Business logic, SOQL, and DML belong in a handler class, keeping one trigger per object and extending any existing trigger framework rather than creating parallel patterns.