Apex Security

Security-first workflow

1. Identify who invokes the code.
2. Identify which records the caller should be able to see/change.
3. Identify object and field permissions.
4. Identify whether the operation intentionally requires elevated privileges.
5. Choose sharing and data-access mode explicitly.
6. Test both authorized and unauthorized cases.

Rules