[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572447-105":53,"doc-detail-572447-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","secure-coding-guide-version-68-security-and-web-vulnerabilities","Secure Coding Guide - Version 68 - Security and Web Vulnerabilities","","Secure Coding Guide (Version 68.0, Winter ’27) provides practical, reference-style security guidance for Salesforce applications built on or integrated with the Lightning Platform. It emphasizes secure design and implementation patterns, including threat-aware flow planning, correct execution context selection, and use of subflows to separate privileged and unprivileged operations. It also covers common web vulnerability areas such as cross-site scripting, SQL injection, CSRF, session ID handling, open redirects, clickjacking, and authorization/access control testing and hardening.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/secure-coding-guide-version-68-security-and-web-vulnerabilities/572447/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/secure-coding-guide-version-68-security-and-web-vulnerabilities/572447.png","ImageObject",442,249,{"name":88,"@type":89},"asda1da","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the purpose of this Secure Coding Guide?","Question",{"text":109,"@type":110},"It is a practical reference for common security issues identified while auditing Salesforce apps built on or integrated with the Lightning Platform. It includes notes on where the platform provides full or partial protection.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How should flows be designed securely in the Lightning Platform?",{"text":114,"@type":110},"Incorporate key security principles into planning, implement flows with care because subscriber-org code can invoke flows in any context, and use subflows to modularize and control execution context.",{"name":116,"@type":107,"acceptedAnswer":117},"What execution context options affect CRUD/FLS behavior for flows?",{"text":118,"@type":110},"User Mode automatically applies permissions and CRUD/FLS rules. System Mode With Sharing applies sharing rules but does not enforce CRUD/FLS. System Mode Without Sharing returns all records and is intended for specific guest-user scenarios with additional validations.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572447,1792098761,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},3985747861852,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Secure Coding Guide  \nVersion 68.0, Winter ’27  \nLast updated: September 25, 2026  \n© Copyright 2000–2026 Salesforce, Inc. All rights reserved. Salesforce is a registered trademark of Salesforce, Inc., as are other names and marks. Other marks appearing herein may be trademarks oftheir respective owners.  \nCONTENTS  \nChapter 1: Secure Coding Guidelines ...................................... 1  \nChapter 2: Security Considerations for Flow Design ........................... 2  \nChapter 3: Security Considerations for Session IDs ........................... 4  \nChapter 4: Secure Coding Cross Site Scripting ............................... 6  \nChapter 5: Secure Coding SQL Injection ................................... 36  \nAlternate Methods to Secure SOQL Queries .................................... 41  \nHow to Ensure SOQL Query Security with Third-Party Libraries and APIs ................. 41  \nHow Do I Protect My Non-Salesforce Application? ............................... 42  \nBest Practices for Preventing SQL Injection Across Various Technologies ................ 42  \nHow Can I Test My Application? ........................................... 44  \nChapter 6: Secure Coding Cross Site Request Forgery ........................ 45  \nProtect Your Application from CSRF Vulnerabilities ............................... 46  \nChapter 7: Secure Coding Secure Communications .......................... 49  \nChapter 8: Storing Sensitive Data ....................................... 54  \nChapter 9: Open Redirect Vulnerabilities .................................. 60  \nProtect Your App from Open Redirect Vulnerabilities .............................. 61  \nChapter 10: Understand Clickjacking ..................................... 65  \nChapter 11: Authorization and Access Control .............................. 67  \nTest Your Application for Vulnerabilities ...................................... 68  \nProtect Your Application from CRUD/FLS Vulnerabilities ........................... 68  \nProtect Your Application from Sharing Violations ................................ 72  \nChapter 12: Lightning Security .......................................... 74  \nChapter 13: Marketing Cloud Engagement API Integration Security .............. 84  \nChapter 14: Secure Coding PostMessage ................................. 87  \nChapter 15: Secure Coding WebSockets .................................. 89  \nChapter 16: Platform Security FAQs ...................................... 90  \nCHAPTER 1 Secure Coding Guidelines  \nThis guide walks you through the most common security issues Salesforce has identified while auditing applications built on or integrated with the Lightning Platform.  \nThis guide takes into account that many of our developers write integration pieces with the Lightning Platform and includes examples from other web platforms such as Java, ASP. NET, PHP and Ruby on Rails. The Lightning Platform provides full or partial protection against many of these issues. It is noted when this is the case.  \nConsider this to be an easy to read reference and not a thorough documentation of all web application security flaws. More details on a broader spectrum of web application security problems can be found on the OWASP (Open Web Application Security Project) site.  \nCHAPTER 2 Security Considerations for Flow Design  \nIncorporate key security principles into your planning process to securely design, implement, and manage flows.  \nDevelop Flows Securely  \n\n| Flows act like global classes and don’t have any IP protections for flow code. Create flow code carefully, as any code on the subscriber org can invoke the flow in any context.\u003Cbr>Use Subflows |\n| --- |\n| Use subflows to modularize your processes and control execution context. You can run a main flow in User Mode and run privileged operations in a System Mode subflow. For example, your main flow createsan opportunity in User Mode, and the subflow assigns ownership in System Mode.\u003Cbr>Dividing flows into privileged and unprivi","cbCaigsJfiK6VVBD","https://ap.wps.com/l/cbCaigsJfiK6VVBD","pdf",1209302,98,"English","# Chapter 1 Secure Coding Guidelines\n# Chapter 2 Security Considerations for Flow Design\n# Chapter 3 Security Considerations for Session IDs\n# Chapter 4 Secure Coding Cross Site Scripting\n# Chapter 5 Secure Coding SQL Injection\n# Chapter 6 Secure Coding Cross Site Request Forgery\n# Chapter 7 Secure Coding Secure Communications\n# Chapter 8 Storing Sensitive Data\n# Chapter 9 Open Redirect Vulnerabilities\n# Chapter 10 Understand Clickjacking\n# Chapter 11 Authorization and Access Control\n# Chapter 12 Lightning Security\n# Chapter 13 Marketing Cloud Engagement API Integration Security\n# Chapter 14 Secure Coding PostMessage\n# Chapter 15 Secure Coding WebSockets\n# Chapter 16 Platform Security FAQs","[{\"question\":\"What is the purpose of this Secure Coding Guide?\",\"answer\":\"It is a practical reference for common security issues identified while auditing Salesforce apps built on or integrated with the Lightning Platform. It includes notes on where the platform provides full or partial protection.\"},{\"question\":\"How should flows be designed securely in the Lightning Platform?\",\"answer\":\"Incorporate key security principles into planning, implement flows with care because subscriber-org code can invoke flows in any context, and use subflows to modularize and control execution context.\"},{\"question\":\"What execution context options affect CRUD/FLS behavior for flows?\",\"answer\":\"User Mode automatically applies permissions and CRUD/FLS rules. System Mode With Sharing applies sharing rules but does not enforce CRUD/FLS. System Mode Without Sharing returns all records and is intended for specific guest-user scenarios with additional validations.\"}]","Secure Coding Guide - Version 68 - Security and Web Vulnerabilities | PDF",1791927439,34]