FAQ-000395 - Community and Experience Cloud Security / Data Access and Record Security

To securely grant community or portal users access to records in a managed package, follow these best practices: 1. **Guest User Sharing Rules**: Create explicit sharing rules to grant access to specific records for guest users. 2. **Secure Guest User Record Access**: Enable the "Secure Guest User Record Access" setting to enforce a private Organization-Wide Default (OWD) for guest users. 3. **Avoid Manual Sharing**: Do not use manual or Apex sharing for guest users, as these are not best practices. 4. **Encrypt Sensitive Data**: Use encryption (e.g., AES256) for sensitive information like record IDs, and store keys securely in protected settings or metadata. 5. **System Mode for Critical Operations**: Run critical operations in system mode without sharing to bypass user permissions securely. 6. **CRUD/FLS Checks**: Enforce CRUD (Create, Read, Update, Delete) and FLS (Field-Level Security) checks in Apex code to prevent unauthorized access. 7. **Reassign Record Ownership**: Automate processes to reassign records created by guest users to a default owner for better control. 8. **Avoid Public Groups for Guest Users**: Do not include guest users in public groups to prevent unintended access. These practices ensure secure and controlled access to records for community or portal users.