logo

Security Misconfiguration

Security misconfiguration occurs when security settings are not implemented or are configured incorrectly. This can happen at any level of an application stack, including the web server, application server, database, platform, or framework. Attackers can exploit security misconfigurations to gain unauthorized access, escalate privileges, and execute arbitrary code.

Anti-patterns

Hardcoded IDs in code

Record IDs change between environments. For this reason, any logic that uses hardcoded IDs will fail when deployed to a different Salesforce environment.
View anti-pattern

Hardcoded callouts authentication

Named credentials make callouts much easier to maintain. For example, if an endpoint URL changes, named credentials allow updating it without any code changes. Furthermore, named credentials don’t need remote site settings, otherwise required for callouts to external sites via Apex.
View anti-pattern

Hardcoded IDs in flow

Record IDs change between environments. For this reason, any logic that uses hardcoded IDs will fail when deployed to a different Salesforce environment.
View anti-pattern

Disabled Lightning Locker

Lightning Locker is the built-in security architecture for Lightning components. It enhances security by promoting several best practices, including eliminating access to specific APIs and framework internals. Lightning Locker can be disabled for an Aura component by setting the Salesforce API version to 39.0 or lower for the component. If an element is set to at least API version 40.0, Lightning Locker is enabled.
View anti-pattern

Autocompletion enabled on password fields

The user browser can save and remember the entered values for user input fields with autocomplete-enabled attributes. This might reveal sensitive information like passwords, especially on public and multi-user computers.
View anti-pattern

Hardcoded IDs in configuration

Record IDs change between environments. For this reason, any logic that uses hardcoded IDs will fail when deployed to a different Salesforce environment.
View anti-pattern