Home / security
Security skills (49)
Platform security and compliance: hardening, encryption, session policy, MFA, monitoring, record-access troubleshooting.
- apex-managed-sharing-patternsGrant row-level access programmatically via __Share records when declarative sharing rules cannot express the policy. NOT for OWD, role hierarchy, or criteria-based sharing rule design — use admin/sharing-and-visibility.
- api-only-user-hardeningProvision and harden integration (API-only) users: no UI login, IP restrictions, minimum permission set, session lifetime, and monitoring. NOT for human admin account hardening — use admin/integration-user-management.
- api-security-and-rate-limitingAPI rate limits, Connected App scope restriction, OAuth API security auditing.
- certificate-and-key-managementUse this skill when creating, uploading, or rotating certificates in Salesforce, configuring mutual TLS (mTLS) client authentication, managing the Java KeyStore for CA-signed certificates, diagnosing certificate expiry.
- clickjack-and-frame-protectionConfigure clickjack protection headers and frame-ancestors for VF pages, LWR sites, and Aura apps. NOT for CSP or Trusted URL configuration — use security/csp-and-trusted-urls.
- connected-app-security-policiesManaging OAuth policies, IP relaxation, session security, PKCE, and credential rotation for Salesforce Connected Apps.
- csp-and-trusted-urlsConfigure Content Security Policy via Trusted URLs and CSP Trusted Sites so Lightning, LWR, and LWC can call third-party scripts, APIs, and frame sources. NOT for clickjack configuration — use lwc/static-resources-in-lwc.
- customer-data-request-workflowImplement GDPR/CCPA data subject rights (access, deletion, rectification) using Salesforce Privacy Center and/or custom workflow.
- data-classification-labelsClassify Salesforce fields by data sensitivity and compliance category using the four built-in classification attributes (SecurityClassification, ComplianceGroup, BusinessOwnerId, BusinessStatus).
- dynamic-sharing-recalculationForce or orchestrate sharing recalculation after bulk data loads, rule changes, or user/role reorgs so row access catches up with policy. NOT for designing new sharing rules — use sharing-selection tree — use data/sharing-recalculation-performance.
- encrypted-field-query-patternsDesign SOQL, filters, reporting, and indexes against Shield Platform Encryption fields.
- event-monitoringShield Event Monitoring: event log types, downloading logs via REST API and SOQL, real-time event monitoring with streaming API, and threat detection policies.
- experience-cloud-securityUse when configuring access controls, sharing, or site security for authenticated or guest Experience Cloud (community) users: external OWD, Sharing Sets, Share Groups, CSP, clickjack protection, guest user record access.
- ferpa-compliance-in-salesforceUse this skill when implementing FERPA (Family Educational Rights and Privacy Act) compliance controls in Salesforce Education Cloud or Education Data Architecture (EDA): LearnerProfile FERPA boolean fields.
- field-audit-trailSalesforce Shield Field Audit Trail: configuration, retention policies, querying archived field data, compliance requirements. NOT for field history tracking (use field-history-tracking) — use data/field-history-tracking.
- file-upload-virus-scanningUse when designing malware and content scanning for files uploaded to Salesforce (Files, Attachments, ContentVersion) — external scanning service callouts, quarantine patterns, and user-facing messaging.
- gdpr-data-privacyUse this skill when implementing GDPR or CCPA data privacy controls in Salesforce: Individual sObject linkage, consent tracking, Right to Be Forgotten (RTBF) requests, data subject request handling, and Privacy Center configuration.
- guest-user-securityUse when hardening the Experience Cloud guest user profile, controlling unauthenticated access to records and Apex, or investigating data exposure through guest SOQL.
- guest-user-security-auditAudit Experience Cloud guest user access — object/field CRUD, sharing, login, and hardening.
- ip-range-and-login-flow-strategyDesign and implement Salesforce Login Flows (Screen Flows assigned to profiles or Experience Cloud sites) that run post-authentication to enforce conditional MFA, IP-based branching, terms-of-service acceptance, or Experience Cloud custom login pages.
- ip-relaxation-and-restrictionDesign IP-based access controls: profile login IP ranges, org-wide trusted IPs, IP relaxation per profile, and the interaction with MFA and SSO.
- login-forensicsInvestigate Salesforce login activity using LoginHistory, IdentityVerificationHistory, and Login Forensics (Event Monitoring add-on): reconstruct per-user login timelines, identify failed logins, analyze source IPs, review identity verification events, and...
- mfa-enforcement-patternsDesign MFA enforcement: auto-enablement, Authenticator rollout, exceptions, API-only users, SSO interop. Triggers: MFA enforcement, MFA exception, api-only MFA, MFA SSO. NOT for org-wide MFA policy sequencing — use security/mfa-enforcement-strategy.
- mfa-enforcement-strategyOrg-wide MFA rollout strategy, phased enablement, exception governance, and audit. Triggers: MFA rollout plan, MFA policy, MFA governance. NOT for per-user-type enforcement patterns — use security/mfa-enforcement-patterns.
- network-security-and-trusted-ipsConfigure and audit Salesforce network security controls — trusted IP ranges (org-wide Network Access), login IP ranges on profiles, CSP Trusted Sites for Lightning components, CORS allowlists for external JavaScript, and TLS requirements — and troubleshoot...
- oauth-redirect-and-domain-strategyDesign Connected App OAuth callback URLs, My Domain naming, Enhanced Domains cutover, and cross-environment redirect handling.
- oauth-token-managementUse when work depends on how Salesforce OAuth access and refresh tokens are issued, refreshed, rotated, revoked, or introspected for a Connected App or API client—including unexpected logouts, invalid_grant after refresh, or designing token incident response.
- org-hardening-and-baseline-configUse when defining or reviewing baseline org hardening settings, especially Security Health Check gaps, clickjack and browser protections, CSP and CORS governance, password/session policies, network restrictions, and release-update hygiene.
- permission-set-groups-and-mutingUse when designing or reviewing permission-set-group architecture, especially profile minimization, group composition, muting strategy, and migration away from profile-heavy security models.
- platform-encryptionUse this skill when deciding which Salesforce fields to encrypt at rest, choosing between deterministic and probabilistic schemes, and managing tenant secrets and keys.
- privileged-access-managementDesign just-in-time elevation, break-glass accounts, and audit trails for Modify All Data / System Admin / Customize Application permissions. NOT for regular permission set design — use admin/permission-set-architecture.
- recaptcha-and-bot-preventionUse when configuring reCAPTCHA on Web-to-Case, Web-to-Lead, Experience Cloud forms, or Headless Identity flows, or when designing bot-mitigation strategies for Salesforce public-facing surfaces.
- record-access-troubleshootingDiagnose why a user can or cannot see/edit a record: UserRecordAccess SOQL, Why Can a User Access This Record debug log, OWD, role hierarchy, sharing rules, manual/team/apex shares, implicit parent share.
- salesforce-shield-deploymentRoll out Shield (Platform Encryption + Event Monitoring + Field Audit Trail) end-to-end, sequencing feature enablement to avoid data lockout. NOT for Classic Encryption or general PE design — use architect/salesforce-shield-architecture.
- sandbox-data-maskingUse this skill when configuring or reviewing Salesforce Data Mask to protect PII/PHI in partial or full copy sandboxes after a refresh.
- scim-provisioning-integrationUse when designing or reviewing SCIM-based user lifecycle provisioning into Salesforce from Okta, Azure AD / Entra, or another IdP — create/update/deactivate, group-to-permission-set mapping, attribute mapping, and deprovisioning semantics.
- secure-coding-review-checklistUse this skill to audit Apex, Visualforce, LWC, and Aura code for Salesforce security review readiness — covering CRUD/FLS enforcement, SOQL injection, XSS, CSRF, and open redirects.
- security-health-checkUse when running, interpreting, or acting on Salesforce Security Health Check results — reading the score, understanding risk categories, evaluating specific settings, creating or importing a custom baseline.
- security-incident-responseWhen to use: active or suspected Salesforce org compromise, unauthorized access investigation, attacker containment, forensic evidence collection from EventLogFile/LoginHistory, session revocation, OAuth token cleanup.
- service-account-credential-rotationUse when designing credential rotation for integration users, connected apps, named credentials, and OAuth client secrets in Salesforce.
- session-high-assurance-policiesEnforce step-up authentication for sensitive pages/objects using High Assurance session level and login flow policies. NOT for initial MFA enrollment UX — use admin/org-setup-and-configuration.
- session-management-and-timeoutUse this skill when configuring session timeout values, concurrent session limits, session IP locking, or logout behavior in Salesforce.
- shield-event-log-retention-strategyUse when designing Salesforce Shield Event Monitoring retention, SIEM routing, and storage-tier strategy — which event types to keep, for how long, where, and how to answer audit queries across hot/warm/cold tiers.
- shield-kms-byok-setupConfigure Shield Platform Encryption with customer-supplied (BYOK) or customer-held (Cache-Only Key Service) tenant secrets, rotate them, and recover. NOT for Classic Encryption or field masking — use security/platform-encryption.
- sso-configurationUse when configuring single sign-on into or out of a Salesforce org.
- sso-saml-troubleshootingTroubleshoot SAML SSO failures — assertion errors, certificate mismatch, JIT provisioning. Triggers: SAML error, SSO login failure, assertion invalid. NOT for initial SSO configuration - use security/sso-configuration.
- transaction-security-policiesTransaction Security policy creation and configuration: condition builder, enhanced policies, enforcement actions (block, MFA, notification, end session), real-time monitoring mode, and policy troubleshooting.
- visualforce-security-and-modernizationUse when hardening or modernizing legacy Visualforce pages — covers the platform CSRF token model and when disabling it is a security regression, view state encryption guarantees and the 170 KB ceiling, FLS/CRUD enforcement gaps on `<apex:outputField>` and on...
- xss-and-injection-preventionUse when writing or reviewing Visualforce pages, Apex controllers, or LWC components that output user-supplied data, build dynamic queries, or construct HTTP responses.