Salesforce.
All posts.
Audit Your Agentforce Footprint: Every Agent, Agent User, and Permission in One Pass
Inventory every Agentforce agent, agent user, and permission with sf CLI and SOQL: the exact queries to see what your agents can touch, and from where.
Post-ForcedLeak: Hardening Agentforce Against Prompt Injection (The Setup Steps Nobody Published)
ForcedLeak turned a $5 domain into an Agentforce data-exfiltration channel. The concrete Setup hardening steps to shrink your prompt-injection blast radius.
IPP 3A Is Live: Building New Zealand's Indirect-Collection Notice into Salesforce
New Zealand's IPP 3A now requires notice when you collect personal data indirectly. Build compliance into Salesforce with source fields, a Flow, one report.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.
Salesforce MFA Enforcement Update: What Was Paused, What Still Applies, and the Revised 2026 Dates
Salesforce paused its all-employee MFA enforcement over a security-key enrolment bug and revised the 2026 dates. Here is what moved and what still applies.
Fixing 'Could Not Infer a Metadata Type' in the Salesforce CLI
The Salesforce CLI error 'Could not infer a metadata type' has one message and several causes. A decision tree to find which one you hit, and the fix for each.
Salesforce Data Sovereignty in New Zealand: There's No NZ Region, So What Actually Protects Your Data?
Salesforce has no New Zealand region, so your data sits offshore. What data residency, the US CLOUD Act, and NZISM actually mean for NZ gov and health orgs.
Salesforce Retires the OAuth Username-Password Flow in Winter '27: Migrate Before Your Integrations Break
Salesforce retires the OAuth 2.0 username-password flow for connected apps in Winter '27. What breaks, how to find affected integrations, and how to migrate.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two open-source sf CLI plugins audit Salesforce security from the terminal. One is opinionated and broad, the other configurable and focused. How to pick.
Salesforce Summer '26: The SAML Retirement and Apex Secure-by-Default Changes That Break Orgs Quietly
Two Summer '26 changes break orgs without warning: retiring single-configuration SAML stops SSO logins, and Apex now defaults to with sharing. What to check, where.
Salesforce Security Enforcement in 2026: Every Change, Date, and What Admins Must Do
Across 2026 Salesforce turns a stack of security recommendations into hard enforcement: MFA, report step-up auth, IP blocking and more. The full list and dates.
Salesforce MFA Enforcement in 2026: What Admins Must Verify and Do
Salesforce moves from contractual MFA to hard enforcement in mid-2026, with a stricter phishing-resistant bar for admins. How to verify your org and comply.
Why Salesforce Health Cloud Needs Its Own Security Review
Salesforce Health Cloud holds your most sensitive data, and the features that make it useful are the ones that expose it. What a security review checks.
Mapping Salesforce Security to NZISM, the NZ Privacy Act and ISO 27001
How to map Salesforce security findings to NZISM, the NZ Privacy Act, HISO 10029 and ISO 27001 using a source-verified, version-pinned control catalogue.
sf-audit: 61 Checks, Attack Chains, and Compliance Mapping
We shipped sf-audit v1.0 in April with 23 checks. It's now at 61. Along the way it gained attack chain detection, posture history tracking, and compliance tags across OWASP, SOC 2, ISO 27001, HIPAA, and GDPR.
Org-Dependent Packages: How to Edit in a Sandbox, Pull Changes, and Create a Merge Request
The complete workflow for org-dependent Salesforce packages: make changes in a sandbox, retrieve them with sf CLI, commit to git, and open a merge request. Step by step.
Deploying Salesforce Metadata with sf CLI: From Sandbox to Production
Deploy Salesforce metadata from your local project back to a sandbox or production org using sf CLI, including check-only deploys, reading results, and what to do when deploy fails.
Git Basics for Salesforce Admins: Track Your Org Changes with Version Control
Learn the six git commands every Salesforce admin needs: init, status, add, commit, log, and diff. Includes a real workflow: retrieve a Flow, commit it, change it, see the diff.
Fetching CRM Analytics & Einstein Discovery Metadata with sf CLI: WaveDashboard, WaveRecipe, DiscoveryStory
How to retrieve CRM Analytics (Wave) and Einstein Discovery metadata from Salesforce using sf CLI, including what can and cannot be retrieved via the Metadata API.
Fetching OmniStudio Metadata with sf CLI: OmniScript, DataRaptor, FlexCard, Integration Procedure
How to retrieve OmniScript, DataRaptor (OmniDataTransform), FlexCard (OmniUiCard), and Integration Procedure metadata from Salesforce using sf CLI, with standard runtime requirements and deployment caveats.
Fetching Code Metadata from Salesforce with sf CLI: ApexClass, ApexTrigger, LWC, Aura
How to retrieve ApexClass, ApexTrigger, LightningComponentBundle, and AuraDefinitionBundle metadata from Salesforce using sf CLI, for admins who oversee developers or need to deploy code.
Fetching Security Metadata from Salesforce with sf CLI: Profile, PermissionSet, Role
How to retrieve Profile, PermissionSet, PermissionSetGroup, MutingPermissionSet, and Role metadata from Salesforce using sf CLI, including partial retrieval patterns for large Profile XML.
Fetching Automation Metadata from Salesforce with sf CLI: Flow, WorkflowRule, ApprovalProcess
How to retrieve Flow, WorkflowRule, ProcessBuilder, and ApprovalProcess metadata from Salesforce using sf CLI, with source format, MDAPI format, and package.xml examples.
Fetching Custom Configuration Metadata from Salesforce with sf CLI
How to retrieve CustomObject, CustomField, Layout, FlexiPage, RecordType, and CompactLayout metadata from Salesforce using sf CLI: source format, MDAPI format, and package.xml.
Connecting sf CLI to Your Salesforce Org: sf org login web Complete Guide
How to connect sf CLI to your Salesforce org using sf org login web. Covers sandbox vs production login, org aliases, and verifying your connection.
Setting Up Your Environment: Terminal, sf CLI, and Git for Salesforce Admins
Step-by-step guide to setting up your terminal, sf CLI, and git on Windows or macOS: everything a Salesforce admin needs before working with metadata.
What is Version Control and Why Every Salesforce Admin Needs It
Version control for Salesforce admins explained from scratch: what it is, why your org needs it, and what you can do with git that you can't do today.
We Built a Real-Time RACI Tool in a Weekend. PartyKit Is Why.
We needed a tool for live RACI alignment. Here is why we picked PartyKit over Firebase and raw WebSockets, what it took to build, and what caught us off guard.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
Catch Salesforce Security Gaps in One Command
Most Salesforce orgs are carrying security debt they don't know about. This plugin surfaces it in a single command.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.
Mixed DML Operations: Enterprise User Provisioning Patterns for Salesforce
Master the complex challenge of mixing setup and non-setup object operations in Salesforce user provisioning workflows with production-proven patterns and error handling strategies.
CPU Timeout Resolution: Advanced Debugging and Architecture Patterns for Salesforce Apex
Master advanced techniques for diagnosing, preventing, and recovering from CPU timeout errors in production Salesforce environments with architectural patterns that scale.
Automatic Document Sharing: From Child to Grandparent Records in Salesforce
Learn how to automatically share documents with grandparent records when uploaded to child records using clean, maintainable Salesforce code patterns.
How We Reduced Platform Event Delivery Costs by 60% (And You Can Too)
A deep dive into the hidden costs of Salesforce Platform Events and the surprising optimization that saved us 50,000+ delivery allocations per day
Salesforce Org-to-Org Data Migration: Complete Guide with Tools and Best Practices
Learn how to migrate data between Salesforce organizations with proven strategies, tool recommendations, and code solutions. Complete guide covering relationships, attachments, and migration order.