Team Topologies for Salesforce: The Org Is the Fracture Plane
Team Topologies assumes fracture planes a single Salesforce org does not have. What transfers, what inverts across a multi-org landscape, and why it matters.
Salesforce Is Retiring the Email Change Verification Exemption: Set Up Authorized Email Domains Before Winter '27
Deployable Permission Sets for a Salesforce Delivery Team: Metadata, the CI User, and OmniStudio
Salesforce Report-Export Step-Up Enforcement: The Known Issues and Gotchas Nobody Warned You About
The archive.
Sizing a Salesforce Access Model: Team Shape, Internal vs External Admins, and What It Costs to Run
A full access model is not always the right one. How to size it to your team, flex it for external delivery partners, and what the whole thing costs to run.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Which of Your Salesforce Connected Apps Use Less Than They're Granted? Ask Your Own Logs
Static scanners tell you what a connected app was granted, not what it uses. Here is how to measure the over-grant per object from your own EventLogFile.
A Least-Privilege Access Model for the Salesforce Delivery Team: Tiers, Roles, and Where the Escalation Chain Breaks
How to tier sandboxes, layer profiles and permission set groups, and use the one fact that stops a developer escalating from a sandbox into your production org.
Why Your Developers Don't Need Modify All Data (And What They Actually Need Instead)
Modify All Data is org-wide read and write that does not even override field-level security. Here are the five real requests behind it, and what each one needs.
Agentforce Agent User Least Privilege: What the Wizard Grants, What Your Agent Actually Needs, and How to Audit the Gap
What the Agentforce setup wizard grants your service agent user, what it actually needs, and how to audit both before an attacker maps the gap for you.
Locked Out After Salesforce MFA Enforcement: Recovery Paths, Temporary Codes, and the Break-Glass Account You Should Have Built
Locked out after Salesforce MFA enforcement? The recovery paths, temporary codes, Support realities, and how to build a break-glass admin account for your org.
Audit Your Agentforce Footprint: Every Agent, Agent User, and Permission in One Pass
Inventory every Agentforce agent, agent user, and permission with sf CLI and SOQL: the exact queries to see what your agents can touch, and from where.
Post-ForcedLeak: Hardening Agentforce Against Prompt Injection (The Setup Steps Nobody Published)
ForcedLeak turned a $5 domain into an Agentforce data-exfiltration channel. The concrete Setup hardening steps to shrink your prompt-injection blast radius.
IPP 3A Is Live: Building New Zealand's Indirect-Collection Notice into Salesforce
New Zealand's IPP 3A now requires notice when you collect personal data indirectly. Build compliance into Salesforce with source fields, a Flow, one report.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.
Salesforce MFA Enforcement Update: What Was Paused, What Still Applies, and the Revised 2026 Dates
Salesforce paused its all-employee MFA enforcement over a security-key enrolment bug and revised the 2026 dates. Here is what moved and what still applies.
Fixing 'Could Not Infer a Metadata Type' in the Salesforce CLI
The Salesforce CLI error 'Could not infer a metadata type' has one message and several causes. A decision tree to find which one you hit, and the fix for each.
Salesforce Data Sovereignty in New Zealand: There's No NZ Region, So What Actually Protects Your Data?
Salesforce has no New Zealand region, so your data sits offshore. What data residency, the US CLOUD Act, and NZISM actually mean for NZ gov and health orgs.
Salesforce Retires the OAuth Username-Password Flow in Winter '27: Migrate Before Your Integrations Break
Salesforce retires the OAuth 2.0 username-password flow for connected apps in Winter '27. What breaks, how to find affected integrations, and how to migrate.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two open-source sf CLI plugins audit Salesforce security from the terminal. One is opinionated and broad, the other configurable and focused. How to pick.
Salesforce Summer '26: The SAML Retirement and Apex Secure-by-Default Changes That Break Orgs Quietly
Two Summer '26 changes break orgs without warning: retiring single-configuration SAML stops SSO logins, and Apex now defaults to with sharing. What to check, where.
Salesforce Security Enforcement in 2026: Every Change, Date, and What Admins Must Do
Across 2026 Salesforce turns a stack of security recommendations into hard enforcement: MFA, report step-up auth, IP blocking and more. The full list and dates.
Salesforce MFA Enforcement in 2026: What Admins Must Verify and Do
Salesforce moves from contractual MFA to hard enforcement in mid-2026, with a stricter phishing-resistant bar for admins. How to verify your org and comply.
Why Salesforce Health Cloud Needs Its Own Security Review
Salesforce Health Cloud holds your most sensitive data, and the features that make it useful are the ones that expose it. What a security review checks.
Mapping Salesforce Security to NZISM, the NZ Privacy Act and ISO 27001
How to map Salesforce security findings to NZISM, the NZ Privacy Act, HISO 10029 and ISO 27001 using a source-verified, version-pinned control catalogue.
sf-audit: 61 Checks, Attack Chains, and Compliance Mapping
We shipped sf-audit v1.0 in April with 23 checks. It's now at 61. Along the way it gained attack chain detection, posture history tracking, and compliance tags across OWASP, SOC 2, ISO 27001, HIPAA, and GDPR.
Org-Dependent Packages: How to Edit in a Sandbox, Pull Changes, and Create a Merge Request
The complete workflow for org-dependent Salesforce packages: make changes in a sandbox, retrieve them with sf CLI, commit to git, and open a merge request. Step by step.
Deploying Salesforce Metadata with sf CLI: From Sandbox to Production
Deploy Salesforce metadata from your local project back to a sandbox or production org using sf CLI, including check-only deploys, reading results, and what to do when deploy fails.
Git Basics for Salesforce Admins: Track Your Org Changes with Version Control
Learn the six git commands every Salesforce admin needs: init, status, add, commit, log, and diff. Includes a real workflow: retrieve a Flow, commit it, change it, see the diff.
Fetching CRM Analytics & Einstein Discovery Metadata with sf CLI: WaveDashboard, WaveRecipe, DiscoveryStory
How to retrieve CRM Analytics (Wave) and Einstein Discovery metadata from Salesforce using sf CLI, including what can and cannot be retrieved via the Metadata API.
Fetching OmniStudio Metadata with sf CLI: OmniScript, DataRaptor, FlexCard, Integration Procedure
How to retrieve OmniScript, DataRaptor (OmniDataTransform), FlexCard (OmniUiCard), and Integration Procedure metadata from Salesforce using sf CLI, with standard runtime requirements and deployment caveats.
Fetching Code Metadata from Salesforce with sf CLI: ApexClass, ApexTrigger, LWC, Aura
How to retrieve ApexClass, ApexTrigger, LightningComponentBundle, and AuraDefinitionBundle metadata from Salesforce using sf CLI, for admins who oversee developers or need to deploy code.
Fetching Security Metadata from Salesforce with sf CLI: Profile, PermissionSet, Role
How to retrieve Profile, PermissionSet, PermissionSetGroup, MutingPermissionSet, and Role metadata from Salesforce using sf CLI, including partial retrieval patterns for large Profile XML.
Fetching Automation Metadata from Salesforce with sf CLI: Flow, WorkflowRule, ApprovalProcess
How to retrieve Flow, WorkflowRule, ProcessBuilder, and ApprovalProcess metadata from Salesforce using sf CLI, with source format, MDAPI format, and package.xml examples.
Fetching Custom Configuration Metadata from Salesforce with sf CLI
How to retrieve CustomObject, CustomField, Layout, FlexiPage, RecordType, and CompactLayout metadata from Salesforce using sf CLI: source format, MDAPI format, and package.xml.
Connecting sf CLI to Your Salesforce Org: sf org login web Complete Guide
How to connect sf CLI to your Salesforce org using sf org login web. Covers sandbox vs production login, org aliases, and verifying your connection.
Setting Up Your Environment: Terminal, sf CLI, and Git for Salesforce Admins
Step-by-step guide to setting up your terminal, sf CLI, and git on Windows or macOS: everything a Salesforce admin needs before working with metadata.
What is Version Control and Why Every Salesforce Admin Needs It
Version control for Salesforce admins explained from scratch: what it is, why your org needs it, and what you can do with git that you can't do today.
We Built a Real-Time RACI Tool in a Weekend. PartyKit Is Why.
We needed a tool for live RACI alignment. Here is why we picked PartyKit over Firebase and raw WebSockets, what it took to build, and what caught us off guard.
How to Set Up VS Code as Your Git Merge and Diff Tool: Complete Guide
Configure VS Code as your Git merge and diff tool using the built-in merge editor or external mergetool/difftool. Covers --wait flag, 3-way merge editor, and team setup.
How to Configure Meld as Git Merge and Diff Tool on macOS: Complete Setup Guide
Learn how to install and configure Meld as your Git merge and diff tool on macOS. Covers Homebrew setup, Apple Silicon vs Intel paths, and Gatekeeper fixes.
Git difftool vs mergetool: What's the Difference and When to Use Each
git difftool and git mergetool look similar but solve different problems. Learn which command to run, when to run it, and how to configure each independently.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
Catch Salesforce Security Gaps in One Command
Most Salesforce orgs are carrying security debt they don't know about. This plugin surfaces it in a single command.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.
Mixed DML Operations: Enterprise User Provisioning Patterns for Salesforce
Master the complex challenge of mixing setup and non-setup object operations in Salesforce user provisioning workflows with production-proven patterns and error handling strategies.
CPU Timeout Resolution: Advanced Debugging and Architecture Patterns for Salesforce Apex
Master advanced techniques for diagnosing, preventing, and recovering from CPU timeout errors in production Salesforce environments with architectural patterns that scale.
Automatic Document Sharing: From Child to Grandparent Records in Salesforce
Learn how to automatically share documents with grandparent records when uploaded to child records using clean, maintainable Salesforce code patterns.
The Specification Crisis: How Different User Personas Complicate Software Development
Explore how different user personas in software development teams create specification drift, amplified by LLMs, and discover solutions for better collaboration.
How We Reduced Platform Event Delivery Costs by 60% (And You Can Too)
A deep dive into the hidden costs of Salesforce Platform Events and the surprising optimization that saved us 50,000+ delivery allocations per day
Salesforce Org-to-Org Data Migration: Complete Guide with Tools and Best Practices
Learn how to migrate data between Salesforce organizations with proven strategies, tool recommendations, and code solutions. Complete guide covering relationships, attachments, and migration order.
How to Configure Meld as Git Merge and Diff Tool on Windows: Complete Setup Guide
Learn how to set up Meld as your default Git merge and diff tool on Windows. Step-by-step configuration guide with troubleshooting tips and alternative tools comparison.
PowerMock, Testing Private Methods
When refactoring isn't an option, PowerMock's Whitebox.invokeMethod lets you test private Java methods directly. Here's when that's justified and how to do it.
Secure APIs against XEE Attacks (XML Injection Attacks)
Learn how to secure your APIs against XML External Entity (XEE) attacks, including XML Injection and XML Expansion attacks, with practical mitigation steps for Java and RestEasy.
Apache Tomcat Valves, Custom Valve
Learn how to implement and configure custom Apache Tomcat Valves to insert logic into the request processing pipeline before your application code runs.
Input Sanitization: Invalid XML Data, Validation
How to sanitize invalid XML 1.0 characters using a precompiled regex in Java, and how to fix validation failures caused by curl request escaping.