skills.rest
grzmol
grzmolCOMMUNITY
Explore all skills by this author →
GitHub

sf-security-model

Enforce Salesforce CRUD, FLS, sharing, and secure-coding rules across Apex, LWC, and permission metadata.

2|Updated Sep 12, 2026
Search Tags:#security#sharing#salesforce#apex#permission sets#crud fls#soql injection
One-click install
npx skills add https://github.com/grzmol/vibe-force --skill sf-security-model-grzmol
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sf-security-model
Source: https://github.com/grzmol/vibe-force/tree/main/skills/sf-security-model
Command: npx skills add https://github.com/grzmol/vibe-force --skill sf-security-model-grzmol

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Salesforce code frequently ships with missing CRUD/FLS enforcement, implicit sharing declarations, SOQL injection, hardcoded secrets, and over-privileged permission sets, and the API 67.0 default-mode change makes older assumptions about system mode actively dangerous. This Skill gives reviewers and coding agents a single authoritative model of the Salesforce security layers plus concrete fix patterns and the static-analysis rules that detect each violation. ## Core Features & Use Cases - Enforcement patterns with code: Canonical implementations of WITH USER_MODE queries, user-mode DML with error introspection, Security.stripInaccessible, describe checks, and Database.queryWithBinds for injection-safe dynamic SOQL. - Permission architecture guidance: Metadata shapes and deployment rules for permission sets, permission set groups, and muting permission sets, replacing profile-based access management. - Vulnerability catalogue: Vulnerable-to-fixed code pairs for SOQL injection, XSS, open redirect, CSRF, hardcoded credentials, and weak crypto, each mapped to its detecting PMD, Graph Engine, or ESLint rule. - Use Case: While reviewing an @AuraEnabled controller in a pull request, apply the PR security checklist to confirm explicit sharing declarations, user-mode database operations, allowlisted dynamic field names, and negative-access tests with System.runAs before approving. ## Quick Start Review my Apex controller and permission set changes against the Salesforce security model and flag any CRUD, FLS, sharing, or injection violations.

Frequently Asked Questions about sf-security-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce CRUD and FLS in Apex?▼

Use WITH USER_MODE on SOQL queries, as user on DML statements, or AccessLevel.USER_MODE on Database methods. For graceful degradation, Security.stripInaccessible removes inaccessible fields, and Schema describe checks support pre-flight gating.

What changed in Salesforce API version 67.0 for Apex security?▼

Database operations default to user mode instead of system mode, classes without a sharing declaration default to with sharing, and WITH SECURITY_ENFORCED is rejected by the compiler. Code must declare explicit sharing keywords and access modes to behave consistently.

How do I prevent SOQL injection in dynamic queries?▼

Use Database.queryWithBinds with a bind map and AccessLevel.USER_MODE so user input is never concatenated into the query string. Object and field names cannot be bound, so allowlist them and verify accessibility with describe calls.

Should I use permission sets or profiles in Salesforce?▼

Ship permission sets composed into permission set groups, using muting permission sets to subtract access, and keep profiles minimal. Profiles are single-valued, merge poorly across parallel work, and cannot be composed like permission sets.

Why does WITH SECURITY_ENFORCED fail to compile?▼

In API version 67.0 and later, WITH SECURITY_ENFORCED is not allowed in Apex SOQL SELECT statements and the compiler rejects it. Replace it with WITH USER_MODE, which also checks the WHERE clause and reports all FLS errors.

Where should Salesforce integration secrets be stored?▼

Outbound credentials belong in External Credentials referenced by Named Credentials, which the platform encrypts with org-specific keys. Never hardcode tokens in Apex; static analysis flags this via ApexSuggestUsingNamedCred and ApexBadCrypto.

Related Skills

Explore More Software Engineering Skills→
padjeipadjei

platform-metadata-retrieve

Retrieve Salesforce metadata from an org to a local project using sf project retrieve start.

Community
Intermediate
angryracoonangryracoon

platform-metadata-deploy

Coordinate Salesforce metadata deployments with validation and dependency ordering.

Community
Advanced
angryracoonangryracoon

dx-code-analyzer-run

Scan Salesforce code for security, performance, and duplication violations.

Community
Advanced
alexmaruccialexmarucci

audit-logs

Query and manage Datadog Audit Trail events through the Datadog API.

Community
Advanced