Most people within the Salesforce ecosystem know that Experience Cloud sites can be created in sandboxes. It is however often overlooked that a public-facing site on a sandbox is reachable from anywhere on the Internet. So what can an attacker do with a sandbox site? 1. They can use
Self-registration looks like a convenient out of the box feature. However if you skip over the details it can quietly hand a newly registered, unverified user access they were never meant to have. Experience cloud includes an out-of-the-box feature that allows guest users to sign-up
A Salesforce Experience Cloud site doesn't send data-populated pages to the browser. It sends a shell. The browser then asks for the data separately, over APIs that are still there when the browser isn't. You don't need to be in a browser to
Security in Experience Cloud starts with knowing who your users are. There are two perspectives on this, firstly the use-case and secondly the technical aspects of their representation. For the use-case, we want to think about who is this person and what is their relationship to your business.