Blog
Security articles on application code, Salesforce orgs and AI coding agents.
How orgs and applications actually get attacked, how attack paths are built, and how to get more security analysis done with fewer tokens. RSS
Salesforce3 Oct 20266 min readWhy Salesforce org security needs scheduled scansSetup edits, new connected apps and permission creep change a Salesforce org every week. Why a one-off audit goes stale, and what scheduled, scan-based review is.Read the post →AgentExchange Security Review1 Oct 20268 min readAgentExchange Security Review false positives: what reviewers acceptHow to write security review false positive documentation for AgentExchange: one entry per finding, evidence a reviewer can check, and what never to claim.Read the post →Salesforce30 Sept 20269 min readApex SOQL injection: examples, fixes and how to find itApex SOQL injection explained with vulnerable and fixed code: bind variables, Database.queryWithBinds, the limits of escapeSingleQuotes and safe dynamic fields.Read the post →Salesforce29 Sept 20269 min readExperience Cloud guest user security: a hardening checklistAn Experience Cloud guest user security checklist: guest profile permissions, guest sharing rules, public APIs, Apex classes, Flows, files and the Aura endpoint.Read the post →AgentExchange Security Review28 Sept 20267 min readAgentExchange Security Review: what fails, and how to pass the first timeCRUD and FLS, sharing, guest access, XSS, secrets and insecure endpoints: what fails AgentExchange (formerly AppExchange) Security Review, and how to find it.Read the post →Salesforce27 Sept 202610 min readWith sharing vs without sharing in Apex, and inherited sharingWith sharing vs without sharing in Apex: what each keyword does, what an omitted keyword means before and after API 67.0, inherited sharing, and safe exceptions.Read the post →Salesforce26 Sept 202610 min readSalesforce Flow security: system context, guests and Apex actionsSalesforce Flow security in practice: system context run modes, screen flows on public sites, flows called from Apex and LWC, and record-triggered data exposure.Read the post →Salesforce25 Sept 20269 min readSalesforce security audit: a repeatable method for consultanciesHow a Salesforce partner runs a repeatable Salesforce security audit for clients: scope, read-only org access, attack paths, evidence, re-test and the handover.Read the post →Salesforce24 Sept 20269 min readLWC security: five places Lightning Web Components go wrongLWC security in practice: innerHTML and lwc:dom="manual", Lightning Web Security, Apex called from components, static resource libraries and postMessage.Read the post →Application security11 Sept 20268 min readThe EU Cyber Resilience Act is live: what software teams must do nowSince 11 September 2026 the CRA reporting deadlines apply: 24 hours, 72 hours, then a final report. What to have ready, from the SBOM to the VEX.Read the post →AI coding agents28 Aug 20268 min readMCP servers are the new attack surfaceA backdoored MCP server, a command injection in a popular proxy, a prompt-injected agent leaking private repos. What went wrong in 2025, and what to check.Read the post →