Tython

Category

Salesforce

News, guidance, and how-tos from across the Salesforce platform.

salesforce · security

Your Salesforce Certificates Are About to Expire More Often. Are You Ready?

Salesforce is overhauling certificate management with three simultaneous changes: shorter certificate lifespans dropping to 47 days by 2029, a dual-use certificate ban effective June 15, 2026, and a root certificate migration to DigiCert Global Root G2 already underway. If your org manages SSO, API integrations, or Experience Cloud domains, these changes require immediate action. Here's what's changing, what will break, and how to prepare.

Scott Covert ·

salesforce · security · compliance

The Security Benchmark for Salesforce: An Open Standard for What 'Secure' Actually Means

The Security Benchmark for Salesforce (SBS) is an open-source, vendor-neutral compliance standard that defines prescriptive, auditable security controls across eleven domains specific to the Salesforce platform. Unlike generic frameworks such as NIST or ISO 27001, SBS translates abstract security principles into testable Salesforce requirements with built-in regulatory mappings for HIPAA, GDPR, SOC 2, and more.

Scott Covert ·

security · integrations · ai · apex · salesforce

Your Salesforce Org Needs a Bouncer: How OAuth Token Exchange Checks IDs at the Door

Secure your Salesforce Org by implementing the OAuth 2.0 Token Exchange flow, a programmatic 'bouncer' that validates IDs at the door for external integrations. This zero-trust approach utilizes an external Identity Provider (IdP) for authentication and a custom Apex handler for granular, scoped authorization in Salesforce. Token Exchange is essential for securing modern Agentic AI workflows that chain Salesforce into complex, multi-system processes.

Scott Covert ·

salesforce · security · compliance · appexchange

Salesforce's Summer Security Wave: Every Deadline Admins and ISVs Need to Know

Salesforce has issued its most aggressive security roadmap yet, starting with a mandatory May 11 deadline for ISVs to implement four critical OAuth controls to prevent credential exfiltration. The overhaul continues through July for admins, introducing mandatory phishing-resistant MFA and step-up authentication for report exports to harden orgs against modern breach vectors.

Scott Covert ·

salesforce · ai · security

Project Glasswing and Claude Mythos: What Frontier AI Vulnerability Discovery Means for Salesforce

Anthropic’s Project Glasswing reveals that frontier AI can now autonomously find and exploit vulnerabilities in general-purpose code, including Salesforce Apex. Since Salesforce isn't part of the initial defensive coalition, the burden of securing custom code and managed packages falls entirely on individual customers. This shift marks the end of 'security through obscurity' for Salesforce orgs, requiring urgent audits and a move toward strict least-privilege architecture.

Scott Covert ·

salesforce · security · integrations

The JWT OAuth Flow: The Gold Standard for Salesforce Server-to-Server Integrations

Integrating a vendor into your Salesforce org shouldn't mean handing over a 'blank check' to your data. 🔐 If your server-to-server integrations are still relying on session IDs or long-lived refresh tokens, you’re carrying unnecessary risk. These methods are common targets for session hijacking and supply-chain attacks. The gold standard? The JWT Bearer OAuth Flow. Check out our latest deep dive on why it’s time to kill the refresh token.

Scott Covert ·

salesforce · security · integrations

Vishing: How the wolf gets invited into the Salesforce hen house

This post deconstructs how attackers use vishing and OAuth device flows to trick Salesforce admins into granting permanent API access. By posing as support and using a simple verification code, hackers bypass MFA and establish persistent backdoors that remain active even after password resets. To defend the org, admins should implement architectural controls like API Access Control, Transaction Security Policies, and IP Restrictions.

Scott Covert ·

← Back to all posts