A Not So Comprehensive Guide to Securing Your Salesforce Organization

Web and REST APIs power modern software but become open doors when insecure. Essential practices include OAuth 2.0 authentication, strict authorization, and input validation.

ForceHound is an open-source Python collector that renders Salesforce profiles, permission sets, and sharing rules as a BloodHound CE identity graph, bringing AD-style attack path analysis to CRM.

ForceHound graph data powers two Salesforce scenarios: transitive escalation from a standard user to ModifyAllData via ManageUsers or AssignPermissionSets, plus Connected App exposure analysis.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.

Discover the cascading risks of malicious Connected Apps in Salesforce. Learn how to assess business impact, secure your org, and protect critical infrastructure.

Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.