Share

Most Salesforce data breaches are not someone finding a hidden hole in the platform. They trace back to architecture decisions nobody reviewed, and Experience Cloud puts those decisions on the open internet for an attacker to find first.

Matt Meyers, CTA, Founder and CEO of EzProtect, hosts Lillie Beiting, author of “Mastering Salesforce Experience Cloud” and an enterprise Salesforce architect, to break down how guest user access, the data model, and custom code create exposure on public sites, and what to change before someone maps it for you.

What you will learn:

  • How attackers enumerate a public site with tools like Aura Inspector, and why the API Enabled toggle does not stop data access through Lightning APIs.
  • How to design the data model as a trust boundary, keep internal objects internal, and grant least-privilege guest permissions per persona.
  • When guest-reachable flows and Apex run in system context instead of user context, and how to enforce sharing and field level security so they cannot.
  • How to review custom LWC, Aura, and AI-generated code for the client-side and ID-injection flaws vibe coding ships by default.

If you run a public Salesforce site, these are the gaps an attacker maps before you do. Watch now and close them first.

 

Your Salesforce data is invaluable—is it truly secure? If you are allowing users to upload files into your Salesforce orgs, you are risk of also uploaded viruses and consequential data breaches. Get in contact with us today. 

By Published On: June 29, 2026Categories: APEX, Cybersecurity, Salesforce, Salesforce Security Office Hours, Video0 Comments

Share

Did you love this blog and wish there could be more?

It is our goal to keep you informed about everything you need to know about Salesforce security to keep your Salesforce data and company safe and secure by providing you with the highest quality of original content.

If this sounds good to you, then sign-up below to be one of the first to know when the next super awesome Salesforce security blog has been released.

Download your free guide today!

Learn if you are at risk and how to start protecting your users!

GET THE FACTS NOW