Security Constraints for Salesforce Code

When to Use

This skill auto-activates when writing, reviewing, or modifying any Apex class, trigger, LWC component, or Visualforce page. It enforces CRUD/FLS checks, sharing model compliance, SOQL injection prevention, and XSS protection for all Salesforce code.

Hard rules that apply to every Apex class, trigger, LWC component, and Visualforce page. Violating any constraint below is a blocking issue that must be fixed before the code is considered complete.

Reference: @../_reference/SECURITY_PATTERNS.md, @../_reference/SHARING_MODEL.md @../_reference/DEPRECATIONS.md

Never Do

Always Do

Sharing Keyword Decision

Apply the correct keyword on every class. Reference: @../_reference/SHARING_MODEL.md

User-facing code (LWC, VF, Aura, REST API)?     -->  with sharing
Utility / helper called from mixed contexts?     -->  inherited sharing
Scheduled batch / system-only processing?        -->  without sharing  (document justification)
Trigger handler?                                 -->  with sharing  (call without sharing helper only if justified)
Inner class?                                     -->  declare explicitly  (does NOT inherit outer class keyword)
Omitted / unsure?                                -->  with sharing

Key rule: sharing context does not propagate to called classes. A with sharing class calling a without sharing class runs the called method without sharing.

Anti-Pattern Table

CRUD/FLS Enforcement Quick Reference

Reference: @../_reference/SECURITY_PATTERNS.md

Prefer WITH USER_MODE / AccessLevel.USER_MODE for all new code (see @../_reference/API_VERSIONS.md for minimum version). Fall back to stripInaccessible only when silent field removal is the desired behavior.

Visualforce Encoding Quick Reference

Use <apex:outputField> or <apex:outputText escape="true"> where possible -- they handle encoding automatically.

Enforcement Priority

When reviewing or writing code, check constraints in this order:

1. Sharing keyword declared on every class (N2, N8, A3)
2. CRUD/FLS enforced on all user-facing SOQL and DML (N1, A1, A2)
3. SOQL injection -- no string concatenation with user input (N3, A4, A9)
4. XSS -- correct encoding in VF; no innerHTML in LWC (N5, A5, A6)
5. Credentials -- no hardcoded secrets; use Named/External Credentials (N6, A7)
6. Logging -- no sensitive data in debug statements (N7)