PinnedChris Feldhacker·Aug 13Restrict Guest User Access to the GraphQL API for Salesforce OrgsEnable this important security setting to close the door on an attack vector that has become a favorite for threat actors.A response icon2A response icon2
PinnedChris Feldhacker·Aug 21, 2025Why OAuth Device Flow is a Security Risk to Salesforce OrgsNot all security standards are appropriate for all applications.A response icon1A response icon1
PinnedChris Feldhacker·Aug 7, 2025Enabling Salesforce API Access ControlPractical guidance to improve org security in a meaningful way through incremental steps
PinnedChris Feldhacker·Oct 14, 2024Execute Anonymous Apex Risks and AlternativesGuidance for practical Salesforce customers in the quest for improved securityA response icon1A response icon1
PinnedChris Feldhacker·Aug 8, 2025Protect Against the Salesforce Data Loader Related Security ThreatsSpecific actions that provide effective protection to Salesforce orgsA response icon1A response icon1
Chris Feldhacker·Feb 19Retrieving Salesforce External Client App OAuth Keys and Secrets in BulkRetrieving OAuth keys and secrets using automation is possible.A response icon3A response icon3
Chris Feldhacker·Sep 16, 2024Time to Retire Salesforce Network AccessRetiring Salesforce Network Access as a Step Toward Zero Trust Security
Chris Feldhacker·Jul 18, 2024How Overuse of Salesforce User Context Increases Security Risk (Part 2)Part 2 — Cascading Impacts
Chris Feldhacker·Jul 18, 2024How Overuse of Salesforce User Context Increases Security Risk (Part 1)Part 1 — Direct Impact
Chris Feldhacker·Jul 18, 2024Using Salesforce System Context In Itself Is Not a Privilege Escalation VulnerabilitySystem Context has a rightful place in the code base of a Salesforce customer org.
