PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SFDC Secure Development Cheat Sheet

bishopfox.com | blog | #secure-development | #csrf | #salesforce | #soql-injection | #appexchange | #cheat-sheet
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Salesforce secure development cheat sheet for passing the AppExchange security review, covering XSS, CRUD/FLS, insecure sharing and storage, SOQL injection, external comms, and CSRF.
Published
Collected

Related coverage

blog · bishopfox.com
Building Security at Scale: The AppExchange Story
The AppExchange origin story: Salesforce's 2007 trust bet, the first Chief Trust Officer, reviews evolving into automated security tooling, and economics that let thousands of developers sell in.
research · projectblack.io
Salesforce Penetration Testing Fundamentals
Salesforce penetration testing fundamentals: enumerate custom objects and fields for access-control issues, review Apex code for SOQL injection and IDORs, and dump objects with aura-dump.
blog · bishopfox.com
SaaS Threats are Escalating: A Follow-Up to Our Recent Analysis
SaaS threat update: UNC6040 (ShinyHunters/Scattered Spider) runs credential attacks and OAuth phishing; suspected nation-state UNC6395 spread beyond Salesloft to 700+ customers.
blog · bishopfox.com
State of the SaaS Security Union
AppOmni CTO Brian Soby on two active SaaS threats: UNC6040 ransoms stolen Salesforce data; UNC6395 breached Salesloft Drift and hit 700+ customers, harvesting secrets for Workspace, M365, and AWS.
blog · bishopfox.com
Google Partner Program – GPP Top 10
The top 10 most common, high-risk bug classes from 200+ Google Partner Program assessments, OWASP-inspired: insufficient authorization, XSS, CSRF, unsafe document processing, and more.
blog · bishopfox.com
Winston Privacy Version 1.5.4
Nine vulnerabilities in the Winston Privacy device 1.5.4 — critical unauthenticated command injection, CSRF, CORS issues, default credentials, undocumented SSH — fixed in 1.5.8.
Back