ApexAdvancedsecuritycrudflssharing
Implement secure Apex with CRUD, FLS, and sharing enforcement
Real World Scenario
Security review found `@AuraEnabled` Apex returning Contact fields without FLS checks, exposing SSN to community users.
Expected Answer
• Use `with sharing` by default; document exceptions with `without sharing` justification
• Schema.sObjectType checks before DML; Security.stripInaccessible for query results
• UserMode vs SystemMode in Apex—prefer USER_MODE in Lightning controllers
• Avoid `without sharing` in user-facing controllers unless elevated access audited
• RunAs tests verifying community user cannot access unauthorized records
• StripInaccessible on SOQL returning fields to LWC
• Regular PMD/Checkmarx scans in CI for security anti-patterns
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Use `with sharing` by default; document exceptions with `without sharing` justification Also consider: Schema.sObjectType checks before DML; Security.stripInaccessible for query results In practice: UserMode vs SystemMode in Apex—prefer USER_MODE in Lightning controllers Optimize for scale and operational observability.
Architect Perspective
Security in Apex is explicit—`with sharing` alone does not enforce FLS. Architects mandate stripInaccessible on all user-facing queries.