FAQ-000560 - Custom Settings and Configuration Security / Technical Implementation and Code Security

The recommended secure method for automating metadata changes from Apex without user interaction is to expose a **REST API Apex endpoint** that can be invoked using a connected app. To ensure security: • Restrict the Apex class to specific profiles or permission sets for controlled access. • Allow the partner to invoke the REST API endpoint to perform metadata deployments securely. • Thoroughly vet the implementation to prevent unintended actions.

The original answer was well-structured but used verbose bullet point formatting that can be simplified for better readability and scanning. I converted the bullet points to a more concise format using bullet symbols instead of dashes, which improves visual clarity while maintaining all the original security advice. No content was removed or added - just refined the formatting for better user experience. Regarding the related security rules: 1. **ApexCSRF** - This rule directly applies because the FAQ recommends exposing a REST API Apex endpoint. CSRF protection is critical for REST endpoints that perform state-changing operations like metadata deployments, and this rule helps identify missing CSRF protections in Apex REST services. 2. **ApexInsecureEndpoint** - This rule is highly relevant since the FAQ's core recommendation involves creating REST API endpoints in Apex. This rule detects insecure endpoint configurations, which is essential for the security approach described in the FAQ. 3. **LimitConnectedAppScope** - The FAQ specifically mentions using "a connected app" to invoke the REST API endpoint. This rule ensures that connected apps have appropriately limited scopes, which aligns perfectly with the FAQ's security guidance about controlled access. 4. **UseHttpsCallbackUrlConnectedApp** - Since the FAQ recommends using connected apps for secure API invocation, this rule ensures that the connected app configuration uses HTTPS callback URLs, which is a fundamental security requirement for the approach described in the FAQ.