sf-security-constraints

To enforce CRUD and FLS in Apex, apply Security.stripInaccessible() and WITH USER_MODE or AccessLevel.USER_MODE during DML and SOQL operations to strip inaccessible fields and prevent unauthorized data access.

Preventing SOQL injection in Apex requires using bind variables instead of string concatenation for user input. This ensures user-supplied data is treated as a value rather than executable code in the query string.

Preventing XSS in LWC and Visualforce requires proper encoding and sanitization patterns. LWC automatically escapes HTML, but Visualforce needs explicit encoding strategies to secure client-side rendering against malicious script execution.

Yes, you can run this security check on Apex classes, triggers, Lightning Web Components, and Visualforce pages during development or code review to surface missing CRUD/FLS, sharing, injection, and XSS vulnerabilities.

Using without sharing in Apex classes bypasses record-level security and risks unauthorized data access. Documented justification is required to enforce governance rules and explain why the specific logic needs to run in system mode.

Automated security guidance identifies missing CRUD/FLS enforcement, sharing context, and injection risks, but developers must still manually implement the recommended bind variables, encoding strategies, and stripInaccessible patterns.