FAQ-000389 - Community and Experience Cloud Security / Component and Application Security

Key data security guidelines for Salesforce Sites implementations include: 1. **Secure Guest User Record Access**: Enable the "Secure Guest User Record Access" setting to enforce a private Organization-Wide Default (OWD) for Guest Users, restricting access to sensitive data. 2. **CRUD and FLS Enforcement**: Implement Create, Read, Update, and Delete (CRUD) and Field-Level Security (FLS) checks in Apex code to ensure proper access control for Guest Users. Use modern approaches like `WITH USER_MODE` for SOQL queries and `AccessLevel.USER_MODE` for Database methods when possible, as these automatically enforce permissions. 3. **Data Validation and Sanitization**: Validate and sanitize all user inputs to prevent injection attacks and ensure data integrity. 4. **Sensitive Data Storage**: Store sensitive data securely using encryption and avoid exposing it in logs or public fields. Use protected custom settings, custom metadata types, or Named Credentials for storing secrets like API keys instead of hardcoding them. 5. **Content Security Policy (CSP)**: Define and enforce a Content Security Policy to prevent unauthorized scripts or content from being executed. 6. **Cross-Site Scripting (XSS) Protection**: Use proper encoding and escaping techniques to prevent XSS vulnerabilities, especially when rendering user-provided data. 7. **Secure File Uploads**: Implement secure file upload mechanisms, ensuring files are scanned and stored securely, particularly for Guest User interactions. 8. **Authentication and Authorization**: Authenticate and authorize all requests, especially those involving privileged actions or access to confidential objects. 9. **Avoid Hardcoding Secrets**: Don't hardcode sensitive information like encryption keys or passwords in the code. Use secure storage mechanisms provided by Salesforce. 10. **Regular Security Testing**: Conduct regular security scans and testing, including manual and automated methods, to identify and address vulnerabilities. These guidelines help ensure robust security for Salesforce Sites implementations.

The FAQ content is generally accurate and comprehensive. I made minor improvements to enhance clarity and align with modern security practices: 1. **CRUD and FLS section**: Added guidance on modern approaches (`WITH USER_MODE` and `AccessLevel.USER_MODE`) while preserving the existing content, following the security approaches guidelines to prioritize modern features. 2. **Sensitive Data Storage section**: Enhanced the existing point about using "protected custom settings" by adding "custom metadata types, or Named Credentials" to provide more complete options for secure storage, and clarified the contrast with hardcoding. 3. **Avoid Hardcoding Secrets section**: Changed "Do not hardcode" to "Don't hardcode" for a more conversational tone per the style guidelines. **Security Rules Selected:** - **ApexCRUDViolation**: Directly relates to point #2 about implementing CRUD checks in Apex code - **ApexSharingViolations**: Relates to point #2 about FLS enforcement and point #1 about Guest User record access - **ApexXSSFromEscapeFalse** and **ApexXSSFromURLParam**: Both relate to point #6 about XSS protection and proper encoding/escaping - **ApexSOQLInjection**: Relates to point #3 about data validation and sanitization to prevent injection attacks - **ApexBadCrypto**: Relates to point #4 about storing sensitive data securely using encryption - **ApexSuggestUsingNamedCred**: Relates to points #4 and #9 about using secure storage for secrets like API keys instead of hardcoding - **AvoidHardcodedCredentialsInFieldDecls**, **AvoidHardcodedCredentialsInVarDecls**, **AvoidHardcodedCredentialsInVarAssign**: All relate to point #9 about avoiding hardcoded secrets - **ProtectSensitiveData**: Relates to point #4 about secure sensitive data storage and avoiding exposure in logs - **VfUnescapeEl**: Relates to point #6 about XSS protection when rendering user data in Visualforce