The Salesforce Data Theft Campaigns, 2025 to 2026: A Verified Timeline and the Audit That Covers All of Them
Four campaigns, three ways in, none a platform bug. The dates and actor names checked against primary sources, plus the audit that covers all three routes.
The archive.
Salesforce Restricts the OAuth Device Flow on 30 November 2026: Your Connected App Has to Become an External Client App
From 30 November 2026 the OAuth device flow works only from local external client apps. Connected apps that use it must migrate or stop authenticating.
Salesforce Retires the OAuth User-Agent Flows on 20 February 2027: Move to Web-Server Flow with PKCE
The OAuth user-agent and hybrid user-agent flows retire on 20 February 2027. What breaks, why a token in the URL is the problem, and where to move next.
Salesforce Strips Non-Public Fields from Aura Action Responses in Spring '27: The Break Only Shows in the Browser
Spring '27 strips non-public system fields from Aura action responses. Why components fail silently, and why no build or Apex test will catch it first.
Salesforce Winter '27 Requires Use Any API Auth for SOAP login(): Find Your Exposure First
Winter '27 requires the Use Any API Auth permission for SOAP API login(), or the call errors. The queries to size your exposure and check who holds it.
Salesforce Certificate Trust Store: Your Own Root CAs, for Named Credentials Only
Winter '27 lets you upload and manage your own root certificates in Salesforce. The scope is narrower than it first looks, and that scope is the story.
Salesforce Lets You Allowlist Chrome Extensions on Experience Cloud Sites
Winter '27 lets you allowlist specific Chrome extensions as trusted URLs on an Experience Cloud site. What it controls, and the two limits that matter.
Migrating Connected Apps to External Client Apps: The Tool Now Covers Packaged and Distributed Apps
Connected apps end in Summer '27. The migration tool now covers packaged and distributed apps, and keeps existing tokens and sessions valid through it.
INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: The Error Names the Wrong Record
The record you are saving is not the problem. It is the one you are pointing at. How to find the real record and why granting Modify All is the wrong fix.
UNABLE_TO_LOCK_ROW: The Error That Is Really About Your Data
Row lock errors surface in code but are usually caused by data shape. Why retrying makes it worse, and how skew turns a working job into a failing one.
System.LimitException: Too many SOQL queries: 101
The limit is per transaction, not per class, so bulkified code still fails when it is fifth in a trigger chain. How to find the real cause and fix it.
Sending PII from Salesforce: Transport Encryption Is the Wrong Control
Encrypting the connection does not solve emailing personal information. What IPP 5 actually asks, and the pattern that keeps the data inside your control.
Sending Email from Salesforce Securely: SMTP Is Not Encrypted by Default
SMTP is cleartext by design and TLS is opportunistic. Why Preferred Verify still sends in the clear, and what to configure so email is actually protected.
Why Filtering Salesforce Event Logs by IP Misses Most of the Incident
Salesforce splits one actor's activity across event types with different identifying fields. Why IP filtering misses the SOQL, and how to correlate safely.
Salesforce Winter '27 Security Readiness: The Release Updates and the Sandbox Window to Test Them
Winter '27 enforces two security changes, not the five widely listed. Three slipped to 2027 or were cancelled. The dates, what breaks, and how to test.
Why Managed Event Subscriptions Should Be How External Systems Subscribe to Your Salesforce Events
External systems subscribing to your events should use managed subscriptions. Why they beat client-managed replay, and how to defend your delivery allocation.
Salesforce Platform Event Delivery Limits: How to Measure, Attribute and Cut Usage
Deliveries are counted per subscriber, so cost grows with consumers rather than event volume. How to measure usage, attribute it per client, and reduce it.
Migrating Legacy Named Credentials Before They Become the Next Salesforce Deadline
Legacy Named Credentials mix secrets and access in one record with no permission set control. Migrate during the Winter '27 window, and how the split works.
Salesforce Cancelled the Profile Permissions Retirement. Migrate Anyway.
The Spring '26 deadline that forced permission set migrations is gone. What the reversal reveals, and why the deadline was never the reason to migrate.
Salesforce Stops Supporting Incorrect Instanced URLs in API Traffic, Now Spring '27
Salesforce postponed the instanced URL enforcement to Spring '27, a third slip. Why hardcoded endpoints break, and how to control the cutover yourself.
Salesforce Licence Audit: What You Are Paying For and What Is Idle
Idle licences and excess permissions are the same failure: nobody removes access when the need ends. One audit answers both questions at the same time.
Salesforce Winter '27 Turns On Profile Filtering: What Breaks, and How to Test It First
Winter '27 enforces Profile Filtering, so users see only their own profile name. What breaks in Flows, validation rules and Apex, and how to test it early.
Large Data Volumes: When a Query Stops Being Selective
Selectivity is a threshold, not a property. A query written when an object held 50,000 records fails at two million, with the same filter and no code change.
Team Topologies for Salesforce: The Org Is the Fracture Plane
Team Topologies assumes fracture planes a single Salesforce org does not have. What transfers, what inverts across a multi-org landscape, and why it matters.
Salesforce Is Retiring the Email Change Verification Exemption: Set Up Authorized Email Domains Before 1 December 2026
Adopt Authorized Email Domains was cancelled. Its replacement enforces 1 December 2026. How to keep your email verification exception before it lands.
Deployable Permission Sets for a Salesforce Delivery Team: Metadata, the CI User, and OmniStudio
Permission set XML you can deploy, how to get the right permission API names out of your own org, and how to scope the CI user and OmniStudio builder roles.
Salesforce Report-Export Step-Up Enforcement: The Known Issues and Gotchas Nobody Warned You About
Blocked exports, a broken Login As, and RPA jobs failing: the practitioner known issues behind Salesforce report-export step-up enforcement in July 2026.
Sizing a Salesforce Access Model: Team Shape, Internal vs External Admins, and What It Costs to Run
A full access model is not always the right one. How to size it to your team, flex it for external delivery partners, and what the whole thing costs to run.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Which of Your Salesforce Connected Apps Use Less Than They're Granted? Ask Your Own Logs
Static scanners tell you what a connected app was granted, not what it uses. Here is how to measure the over-grant per object from your own EventLogFile.
A Least-Privilege Access Model for the Salesforce Delivery Team: Tiers, Roles, and Where the Escalation Chain Breaks
How to tier sandboxes, layer profiles and permission set groups, and use the one fact that stops a developer escalating from a sandbox into your production org.
Why Your Developers Don't Need Modify All Data (And What They Actually Need Instead)
Modify All Data is org-wide read and write that does not even override field-level security. Here are the five real requests behind it, and what each one needs.
Agentforce Agent User Least Privilege: What the Wizard Grants, What Your Agent Actually Needs, and How to Audit the Gap
What the Agentforce setup wizard grants your service agent user, what it actually needs, and how to audit both before an attacker maps the gap for you.
Locked Out After Salesforce MFA Enforcement: Recovery Paths, Temporary Codes, and the Break-Glass Account You Should Have Built
Locked out after Salesforce MFA enforcement? The recovery paths, temporary codes, Support realities, and how to build a break-glass admin account for your org.
Audit Your Agentforce Footprint: Every Agent, Agent User, and Permission in One Pass
Inventory every Agentforce agent, agent user, and permission with sf CLI and SOQL: the exact queries to see what your agents can touch, and from where.
Post-ForcedLeak: Hardening Agentforce Against Prompt Injection (The Setup Steps Nobody Published)
ForcedLeak turned a $5 domain into an Agentforce data-exfiltration channel. The concrete Setup hardening steps to shrink your prompt-injection blast radius.
IPP 3A Is Live: Building New Zealand's Indirect-Collection Notice into Salesforce
New Zealand's IPP 3A now requires notice when you collect personal data indirectly. Build compliance into Salesforce with source fields, a Flow, one report.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.
Salesforce MFA Enforcement Update: What Was Paused, What Still Applies, and the Revised 2026 Dates
Salesforce paused its all-employee MFA enforcement over a security-key enrolment bug and revised the 2026 dates. Here is what moved and what still applies.
Fixing 'Could Not Infer a Metadata Type' in the Salesforce CLI
The Salesforce CLI error 'Could not infer a metadata type' has one message and several causes. A decision tree to find which one you hit, and the fix for each.
Salesforce Data Sovereignty in New Zealand: There's No NZ Region, So What Actually Protects Your Data?
Salesforce has no New Zealand region, so your data sits offshore. What data residency, the US CLOUD Act, and NZISM actually mean for NZ gov and health orgs.
Salesforce Retires the OAuth Username-Password Flow on 20 February 2027: Migrate Before Your Integrations Break
Salesforce postponed the OAuth 2.0 username-password flow retirement to 20 February 2027. What breaks, how to find affected integrations, and how to migrate.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two open-source sf CLI plugins audit Salesforce security from the terminal. One is opinionated and broad, the other configurable and focused. How to pick.
Salesforce Summer '26: The SAML Retirement and Apex Secure-by-Default Changes That Break Orgs Quietly
Two Summer '26 changes break orgs without warning: retiring single-configuration SAML stops SSO logins, and Apex now defaults to with sharing. What to check, where.
Salesforce Security Enforcement in 2026: Every Change, Date, and What Admins Must Do
Across 2026 Salesforce turns a stack of security recommendations into hard enforcement: MFA, report step-up auth, IP blocking and more. The full list and dates.
Salesforce MFA Enforcement in 2026: What Admins Must Verify and Do
Salesforce moves from contractual MFA to hard enforcement in mid-2026, with a stricter phishing-resistant bar for admins. How to verify your org and comply.
Why Salesforce Health Cloud Needs Its Own Security Review
Salesforce Health Cloud holds your most sensitive data, and the features that make it useful are the ones that expose it. What a security review checks.
Mapping Salesforce Security to NZISM, the NZ Privacy Act and ISO 27001
How to map Salesforce security findings to NZISM, the NZ Privacy Act, HISO 10029 and ISO 27001 using a source-verified, version-pinned control catalogue.
Salesforce Attack Chain Detection: When Five Medium Findings Are One Critical Problem
Isolated Salesforce security findings look survivable. Attack chain detection correlates them into named multi-step scenarios, each mapped to real controls.
Org-Dependent Packages: How to Edit in a Sandbox, Pull Changes, and Create a Merge Request
The complete workflow for org-dependent Salesforce packages: make changes in a sandbox, retrieve them with sf CLI, commit to git, and open a merge request. Step by step.
Deploying Salesforce Metadata with sf CLI: From Sandbox to Production
Deploy Salesforce metadata from your local project back to a sandbox or production org using sf CLI, including check-only deploys, reading results, and what to do when deploy fails.
Git Basics for Salesforce Admins: Track Your Org Changes with Version Control
Learn the six git commands every Salesforce admin needs: init, status, add, commit, log, and diff. Includes a real workflow: retrieve a Flow, commit it, change it, see the diff.
Fetching CRM Analytics & Einstein Discovery Metadata with sf CLI: WaveDashboard, WaveRecipe, DiscoveryStory
How to retrieve CRM Analytics (Wave) and Einstein Discovery metadata from Salesforce using sf CLI, including what can and cannot be retrieved via the Metadata API.
Fetching OmniStudio Metadata with sf CLI: OmniScript, DataRaptor, FlexCard, Integration Procedure
How to retrieve OmniScript, DataRaptor (OmniDataTransform), FlexCard (OmniUiCard), and Integration Procedure metadata from Salesforce using sf CLI, with standard runtime requirements and deployment caveats.
Fetching Code Metadata from Salesforce with sf CLI: ApexClass, ApexTrigger, LWC, Aura
How to retrieve ApexClass, ApexTrigger, LightningComponentBundle, and AuraDefinitionBundle metadata from Salesforce using sf CLI, for admins who oversee developers or need to deploy code.
Fetching Security Metadata from Salesforce with sf CLI: Profile, PermissionSet, Role
How to retrieve Profile, PermissionSet, PermissionSetGroup, MutingPermissionSet, and Role metadata from Salesforce using sf CLI, including partial retrieval patterns for large Profile XML.
Fetching Automation Metadata from Salesforce with sf CLI: Flow, WorkflowRule, ApprovalProcess
How to retrieve Flow, WorkflowRule, ProcessBuilder, and ApprovalProcess metadata from Salesforce using sf CLI, with source format, MDAPI format, and package.xml examples.
Fetching Custom Configuration Metadata from Salesforce with sf CLI
How to retrieve CustomObject, CustomField, Layout, FlexiPage, RecordType, and CompactLayout metadata from Salesforce using sf CLI: source format, MDAPI format, and package.xml.
Connecting sf CLI to Your Salesforce Org: sf org login web Complete Guide
How to connect sf CLI to your Salesforce org using sf org login web. Covers sandbox vs production login, org aliases, and verifying your connection.
Setting Up Your Environment: Terminal, sf CLI, and Git for Salesforce Admins
Step-by-step guide to setting up your terminal, sf CLI, and git on Windows or macOS: everything a Salesforce admin needs before working with metadata.
What is Version Control and Why Every Salesforce Admin Needs It
Version control for Salesforce admins explained from scratch: what it is, why your org needs it, and what you can do with git that you can't do today.
We Built a Real-Time RACI Tool in a Weekend. PartyKit Is Why.
We needed a tool for live RACI alignment. Here is why we picked PartyKit over Firebase and raw WebSockets, what it took to build, and what caught us off guard.
How to Set Up VS Code as Your Git Merge and Diff Tool: Complete Guide
Configure VS Code as your Git merge and diff tool using the built-in merge editor or external mergetool/difftool. Covers --wait flag, 3-way merge editor, and team setup.
How to Configure Meld as Git Merge and Diff Tool on macOS: Complete Setup Guide
Learn how to install and configure Meld as your Git merge and diff tool on macOS. Covers Homebrew setup, Apple Silicon vs Intel paths, and Gatekeeper fixes.
Git difftool vs mergetool: What's the Difference and When to Use Each
git difftool and git mergetool look similar but solve different problems. Learn which command to run, when to run it, and how to configure each independently.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
Catch Salesforce Security Gaps in One Command
Most Salesforce orgs are carrying security debt they don't know about. This plugin surfaces it in a single command.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.
Mixed DML Operations: Enterprise User Provisioning Patterns for Salesforce
Master the complex challenge of mixing setup and non-setup object operations in Salesforce user provisioning workflows with production-proven patterns and error handling strategies.
CPU Timeout Resolution: Advanced Debugging and Architecture Patterns for Salesforce Apex
Master advanced techniques for diagnosing, preventing, and recovering from CPU timeout errors in production Salesforce environments with architectural patterns that scale.
Automatic Document Sharing: From Child to Grandparent Records in Salesforce
Learn how to automatically share documents with grandparent records when uploaded to child records using clean, maintainable Salesforce code patterns.
The Specification Crisis: How Different User Personas Complicate Software Development
Explore how different user personas in software development teams create specification drift, amplified by LLMs, and discover solutions for better collaboration.
How We Reduced Platform Event Delivery Costs by 60% (And You Can Too)
A deep dive into the hidden costs of Salesforce Platform Events and the surprising optimization that saved us 50,000+ delivery allocations per day
Salesforce Org-to-Org Data Migration: Complete Guide with Tools and Best Practices
Learn how to migrate data between Salesforce organizations with proven strategies, tool recommendations, and code solutions. Complete guide covering relationships, attachments, and migration order.
How to Configure Meld as Git Merge and Diff Tool on Windows: Complete Setup Guide
Learn how to set up Meld as your default Git merge and diff tool on Windows. Step-by-step configuration guide with troubleshooting tips and alternative tools comparison.
PowerMock, Testing Private Methods
When refactoring isn't an option, PowerMock's Whitebox.invokeMethod lets you test private Java methods directly. Here's when that's justified and how to do it.
Secure APIs against XEE Attacks (XML Injection Attacks)
Learn how to secure your APIs against XML External Entity (XEE) attacks, including XML Injection and XML Expansion attacks, with practical mitigation steps for Java and RestEasy.
Apache Tomcat Valves, Custom Valve
Learn how to implement and configure custom Apache Tomcat Valves to insert logic into the request processing pipeline before your application code runs.
Input Sanitization: Invalid XML Data, Validation
How to sanitize invalid XML 1.0 characters using a precompiled regex in Java, and how to fix validation failures caused by curl request escaping.