sf-security

To enforce CRUD and FLS in Salesforce Apex, use WITH USER_MODE in SOQL queries or AccessLevel.USER_MODE in DML operations. Additionally, apply Security.stripInaccessible to remove inaccessible fields before processing records.

Prevent SOQL injection in dynamic Apex by using bind variables instead of string concatenation. For dynamic sorting, apply whitelist-based validation for sorting parameters to block unauthorized SOQL injection.

Use with sharing or without sharing keywords based on caller context and scheduled processing requirements. Evaluate inherited sharing when a class context must dynamically respect the calling class's sharing rules.

A Salesforce AppExchange security review checks Apex code for CRUD and FLS enforcement, proper sharing mode correctness, and SOQL injection prevention. It also flags hardcoded credentials and insecure DML for remediation.

Yes, you can use Security.stripInaccessible to check field-level security in LWC controllers. It verifies FLS by removing inaccessible fields from query results before returning data to the Lightning web component.

Your Apex class bypasses sharing rules in scheduled jobs because the execution context lacks a defining user sharing setting. You must explicitly declare with sharing or inherited sharing keywords to enforce record visibility.