FAQ-000385 - Community and Experience Cloud Security / Apex and Trigger Security

When working with Apex triggers in a community or experience cloud context, here are the specific security considerations: 1. **Avoid Direct DML on Parameters**: - Do not perform DML operations directly on records passed as parameters. Instead, create a new instance of the object and copy the necessary fields before performing DML. 2. **Sensitive Field Updates**: - For sensitive fields that need to be updated by guest users, derive their values through server-side logic rather than accepting them as parameters from the client. 3. **Field Access for Read Operations**: - Include only the fields required for client-side logic and UI in read operations. Exclude fields used solely for server-side logic. 4. **Guest User Context**: - For unauthenticated guest user contexts, use "without sharing" Apex classes for operations involving queries or DML. 5. **Asynchronous Operations**: - Implement an encrypted token containing the record ID and other identifying properties to ensure secure validation during asynchronous operations. These practices help ensure secure and efficient handling of Apex triggers in community or experience cloud environments.