{"id":43061,"date":"2015-07-24T10:16:21","date_gmt":"2015-07-24T17:16:21","guid":{"rendered":"http:\/\/developer.salesforce.com\/blogs\/engineering\/?p=43061"},"modified":"2025-11-05T02:31:07","modified_gmt":"2025-11-05T09:31:07","slug":"security-internship-women-trust","status":"publish","type":"post","link":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust","title":{"rendered":"Part-time Security Internship sponsored by Women in TRUST"},"content":{"rendered":"<p dir=\"ltr\">\n\t\t\t  <span class=\"postimagessection_specify alignleft\" >\n\t\t\t    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\" class=\"postimages\" width=\"215\" height=\"322\" alt=\"\" \/>\n\t\t\t  <\/span>\n\t\t\tRemember your old campus job working in the school library or computer lab? The pay was OK and you got a bit of real world experience, but it didn\u2019t necessarily prepare you for life after school. You may have had a summer internship and it was fantastic, but it only lasted three months. Why not take the great experience you\u2019d get from a summer internship, skip that campus job and come work (remote is fine!) for the most <a href=\"http:\/\/www.forbes.com\/sites\/alexkonrad\/2014\/08\/20\/marc-benioffs-innovation-secret\/\">innovative company<\/a> in the world filled with some of the <a href=\"https:\/\/www.blackhat.com\/us-15\/speakers\/Hormazd-Billimoria.html\">best<\/a> <a href=\"https:\/\/appsecusa2015.sched.org\/event\/c52302496e4728340cca39edbced2aa1?iframe=yes&amp;w=i:100;&amp;sidebar=yes&amp;bg=no#?iframe=yes&amp;w=i:100;&amp;sidebar=yes&amp;bg=no\">security<\/a> <a href=\"https:\/\/www.blackhat.com\/us-15\/speakers\/Xiaoran-Wang.html\">technologists<\/a> you\u2019ll ever find.<\/p>\n<p dir=\"ltr\">The Women in TRUST group at salesforce.com is sponsoring a part-time security internship during the school year. Trust is salesforce.com\u2019s #1 value, and there is no shortage of opportunities that align with our vision.<\/p>\n<p dir=\"ltr\">The internships are open to all qualified college students. Salesforce.com is an equal opportunity employer and we\u2019re committed to diversity. Security as an industry can be a tough one to get into, and we\u2019d like to see all groups better represented. If you are interested in security and don\u2019t know where to start, this internship could be a good opportunity to get hands on experience in the field and expand your skill set.<\/p>\n<p dir=\"ltr\">If you or someone you know is interested, check out the link to the security internship role below. The position can be remote and we\u2019ll assign you an awesome mentor. So if you\u2019re a technology major with an interest in security &#8211; apply now! \u00a0We\u2019re looking to fill this internship role for the fall semester, so forget about that campus job and don\u2019t delay.<\/p>\n<p>\n\t\t\t  <span class=\"postimagessection_specify alignright\" >\n\t\t\t    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Ch_114-security_kx7nff.jpg\" class=\"postimages\" width=\"103\" height=\"103\" alt=\"\" \/>\n\t\t\t  <\/span>\n\t\t\t<\/p>\n<p dir=\"ltr\"><a href=\"http:\/\/careers.force.com\/jobs\/apex\/ts2__JobDetails?jobId=a1k70000002ZiiXAAS&amp;tSource=\">P<\/a><a style=\"line-height: 1.5em\" href=\"http:\/\/careers.force.com\/jobs\/apex\/ts2__JobDetails?jobId=a1k70000002ZiiXAAS&amp;tSource=\">roduct Security Intern<\/a><span style=\"line-height: 1.5em\"> &#8211; \u00a0Our Product Security team ensures the security of our products and serves as subject matter experts for our R&amp;D teams and AppExchange partners to protect our customers\u2019 data in today\u2019s rapidly evolving security landscape. We are a team of curious minds that specialize in security research, penetration testing, and innovative tool development. Many computer science students have expressed a desire to pursue a career in Security and our Trust Internship program hopes to bridge the gap between academic study and hands-on training in a corporate environment. The overall goal is to inspire these students to continue in the field.<\/span><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Join the best security technologists at the most innovative company in the world, salesforce.com, for a fantastic part-time security internship.<\/p>\n","protected":false},"author":1601,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2765,2534],"tags":[1244,1111,1245,1341],"coauthors":[],"class_list":["post-43061","post","type-post","status-publish","format-standard","hentry","category-professional-development","category-trust-security-accessibility","tag-engineering","tag-security","tag-women-in-tech","tag-women-in-technology"],"podcast_audio":{"audio_url":"","duration":""},"featured_image":"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg","related_posts":[{"post":{"ID":201348,"post_author":"3687","post_date":"2024-04-30 09:00:47","post_date_gmt":"2024-04-30 15:00:47","post_content":"Security is one of the most critical elements of storing your data on a device. We\u2019re excited to announce that in Spring \u201924, Salesforce is introducing the <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.mobile_offline.meta\/mobile_offline\/use_biometricsservice.htm\">BiometricsService<\/a> mobile capability! BiometricsService enables developers to add additional security measures to the data being stored on Lightning web components (LWCs).\r\n\r\nLet\u2019s say, for example, that you are looking to build an LWC to store sensitive data, such as a contact\u2019s physical address and identification information. However, these are sensitive data points that you wouldn\u2019t want just anyone to have access to. Through BiometricsService, you will be able to use security measures, such as FaceID and fingerprint scanning, to add additional security to the data being processed within your Salesforce mobile apps.\r\n\r\nLet\u2019s take a look at how!\r\n<h2>Work with the BiometricsService API<\/h2>\r\nBefore we discuss how to use the BiometricsService API, let\u2019s walk through a quick example of BiometricsService using <a href=\"https:\/\/github.com\/trailheadapps\/dreamhouse-lwc\">Dreamhouse<\/a>, a sample app that features some LWCs for mobile use cases in a real estate context.\r\n\r\nSay that you\u2019re a real estate agent who has closed a deal with a client on a new home, and you are updating the Opportunity information in Salesforce. To process the transaction, you will need to collect the following paperwork and personal details on the Opportunity record.\r\n<ul>\r\n \t<li>Purchase agreements<\/li>\r\n \t<li>Buyer and seller details\r\n<ul>\r\n \t<li>Phone numbers<\/li>\r\n \t<li>Current residency details<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>Purchased home address information<\/li>\r\n \t<li>And more!<\/li>\r\n<\/ul>\r\nYou are filling out these details on the spot, and given the sensitive nature of the data you are updating, you do not want just anyone to have access to this information when they are accessing your device. As you go from one place to another, you will need to access this information, but what if you misplace your phone or someone else not authorized to access this data attempts to do so? How can you stop this?\r\n\r\nEnter BiometricsService! Using the BiometricsService API, you can add security measures, such as fingerprint unlock or Face ID scan, so that you have an additional security measure on the device at all times. You are protecting sensitive data access on the Opportunity record directly via the LWC.\r\n\r\n<i><b>Note:<\/b> BiometricsService is a mobile-only capability via LWC. It does not support biometrics unlock of LWCs when configured via web devices using features like fingerprint scan via Touch ID on desktop.<\/i>\r\n<h2><b>Configure the BiometricsService API <\/b><\/h2>\r\nThe BiometricsService API enables you to verify device ownership when interfacing with an LWC. This can be done through two steps:\r\n<ol>\r\n \t<li>Configure your LWC HTML template to include a <code>lightning-button<\/code> base component. This will be used to prompt the user for biometric authentication.<\/li>\r\n \t<li>Connect that button with the JavaScript API that BiometricsService provides to invoke auth capabilities.<\/li>\r\n<\/ol>\r\n<i><b>Note:<\/b> To use BiometricsService, the end user looking to use the functionality on a mobile device must first have a fingerprint or Face ID scan pre-configured on the device. Reference the official <a href=\"https:\/\/support.apple.com\/guide\/iphone\/set-up-touch-id-iph672384a0b\/ios\">iOS<\/a> and <a href=\"https:\/\/developer.android.com\/codelabs\/biometric-login#0\">Android<\/a> device on how to configure. <\/i>\r\n\r\nLet\u2019s dive into more details on these steps!\r\n<h3><b>Step 1: Configure your LWC HTML template<\/b><\/h3>\r\nFor this LWC, we\u2019ll use the <code>handleVerifyClick<\/code> onclick method call, which invokes the API we\u2019ll need to begin using BiometricsService on LWC. This onclick method can be housed in the <code>lightning-button<\/code> HTML base component which, when invoked, will begin prompting the user for device ownership.\r\n\r\n<i><b>Tip:<\/b> When prompting biometric auth, you would want it to be a very upfront action for the end user trying to access the LWCs holding the aforementioned sensitive data. As such, a general recommendation is to house the <code>lightning-button<\/code> component within a <code>lightning-card<\/code> base component, which will render a card-style modal as a banner at the forefront for users when attempting to access sensitive data.<\/i>\r\n<pre language=\"html\">&lt;template&gt;\r\n  &lt;lightning-card title=&quot;Biometrics Service Demo&quot; icon-name=&quot;custom:privately_shared&quot;&gt;\r\n    &lt;div class=&quot;slds-var-m-around_medium&quot;&gt;\r\n      Use device biometrics capabilities to verify current user is indeed device owner:\r\n      &lt;lightning-button\r\n        variant=&quot;brand&quot;\r\n        label=&quot;Verify&quot; \r\n        title=&quot;Verify device ownership using biometrics&quot;\r\n        onclick={handleVerifyClick}\r\n        class=&quot;slds-var-m-left_x-small&quot;&gt;\r\n      &lt;\/lightning-button&gt;\r\n    &lt;\/div&gt;\r\n    &lt;div class=&quot;slds-var-m-around_medium&quot;&gt;\r\n      &lt;lightning-formatted-text value={status}&gt;&lt;\/lightning-formatted-text&gt;\r\n    &lt;\/div&gt;\r\n  &lt;\/lightning-card&gt;    \r\n&lt;\/template&gt;\r\n<\/pre>\r\nOnce those HTML configs are set, you will get a view of BiometricsService running within your LWC. Here is a sample view of the HTML payload from above, running in iOS:\r\n\r\n<img src=\"https:\/\/developer.salesforce.com\/blogs\/wp-content\/uploads\/2024\/04\/image-2024-04-29T143243.496-507x1000.png\" alt=\"The BiometricsService mobile capability running on LWC in iOS\" width=\"507\" height=\"1000\" class=\"alignnone size-medium wp-image-201349\" \/>\r\n<h3><b>Step 2: Connect your user interface with the BiometricsService API<\/b><\/h3>\r\nIn Step 1, we configured the <code>handleVerifyClick<\/code> method on the LWC in the HTML file. Here we will need to connect that method to the BiometricsService API that we import via <code>mobileCapabilities<\/code>.\r\n\r\nYou can use the following API calls to interface with BiometricsService.\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td>API Call<\/td>\r\n<td>Params<\/td>\r\n<td>Response<\/td>\r\n<td>Description<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><code><a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-factory.html\">getBiometricsService<\/a><\/code><\/td>\r\n<td>None<\/td>\r\n<td><code>BiometricsService<\/code><\/td>\r\n<td>Initializes Biometrics Service in your JavaScript class after importing the module from the <a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-mobilecapabilities.html\">lightning\/MobileCapabilities module<\/a>.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><code><a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-isavailable.html\">isAvailable<\/a><\/code><\/td>\r\n<td>None<\/td>\r\n<td><code>true \/ false<\/code><\/td>\r\n<td>Allows you to check whether BiometricsService is available on device to invoke. Reference our <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.mobile_offline.meta\/mobile_offline\/use_biometricsservice_compatibility.htm\">Compatibility &amp; Requirements<\/a> for more details on list of supported devices.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><code><a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-isbiometricsready.html\">isBiometricsReady<\/a><\/code><\/td>\r\n<td>None<\/td>\r\n<td><code>true \/ false<\/code><\/td>\r\n<td>Checks whether Biometrics is ready to use after it has been initialized.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><code><a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-checkuserisdeviceowner.html\">checkUserIsDeviceOwner<\/a><\/code><\/td>\r\n<td>String (<a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-data-types.html\">Options<\/a>)<\/td>\r\n<td><code>true \/ false<\/code><\/td>\r\n<td>Allows you to check whether the fingerprint or Face ID scanned matches with the fingerprint or Face ID scan that is provided by the user on the mobile device.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\nWhen using this API in your JavaScript LWC code, it would look like this:\r\n<pre language=\"javascript\">import { LightningElement } from 'lwc';\r\nimport { getBiometricsService } from 'lightning\/mobileCapabilities';\r\n\r\nexport default class NimbusPluginBiometricsService extends LightningElement {\r\n    status;\r\n    biometricsService;\r\n\r\n    connectedCallback() {\r\n      this.biometricsService = getBiometricsService();\r\n    }\r\n\r\n    handleVerifyClick() {\r\n      if (this.biometricsService.isAvailable()) {\r\n        const options = {\r\n          permissionRequestBody: \"Required to confirm device ownership.\",\r\n          additionalSupportedPolicies: ['PIN_CODE']\r\n        };\r\n        this.biometricsService.checkUserIsDeviceOwner(options)\r\n          .then((result) =&gt; {\r\n            \/\/ Do something with the result\r\n            if (result === true) {\r\n              this.status = \"\u2714 Current user is device owner.\"\r\n            } else {\r\n              this.status = \"\ud800\udd02 Current user is NOT device owner.\"\r\n            }\r\n          })\r\n          .catch((error) =&gt; {\r\n            \/\/ Handle errors\r\n            this.status = 'Error code: ' + error.code + '\\nError message: ' + error.message;\r\n          });\r\n      } else {\r\n        \/\/ service not available\r\n        this.status = 'Problem initiating Biometrics service. Are you using a mobile device?';\r\n      }\r\n    }\r\n}\r\n<\/pre>\r\n<b>Important Notes<\/b>\r\n<ul>\r\n \t<li>The <code>options<\/code> constant is a required parameter, and when checking device ownership, the <code>addionalSupportedPolicies<\/code> object allows you to configure the fallback options in the event that the biometrics scan fails. In this case, adding <code>PIN_CODE<\/code> in the object array will alert BiometricsService to prompt for the device pin code as the fallback.<\/li>\r\n \t<li>If the barcode scan fails, it will return a set of failure codes. Reference <a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/reference-lightning-biometricsservice-constants.html#biometricsservicefailurecode\">BiometricsServiceFailureCodes<\/a> for more details.<\/li>\r\n<\/ul>\r\n<h2>BiometricsService compatibility<\/h2>\r\nBiometricsService is available in the Spring \u201924 release across the Salesforce Mobile App, Salesforce Mobile App Plus, and Mobile Publisher offerings. See the <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.mobile_offline.meta\/mobile_offline\/capabilities.htm\">Mobile Capabilities Compatibility Summary<\/a> to stay up to date with its availability across our Salesforce mobile apps.\r\n<h2><b>Conclusion<\/b><\/h2>\r\nWe hope that you\u2019ve enjoyed this blog post and that you are looking forward to using the biometrics scanning capabilities on your LWC for mobile. To get started:\r\n<ul>\r\n \t<li><b>Dive in!<\/b> Take a look at our <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.mobile_offline.meta\/mobile_offline\/use_biometricsservice.htm\">example LWCs<\/a> to get familiar with the plugin.<\/li>\r\n \t<li><b>Personalize it!<\/b> Take BiometricsService capabilities and expand on them to customize them for your business needs.<\/li>\r\n \t<li><b>Reach out!<\/b> If you have any questions, comments, or ideas, you can connect with us in the <a href=\"https:\/\/trailhead.salesforce.com\/trailblazer-community\/groups\/0F9300000001qepCAA?tab=discussion&amp;sort=LAST_MODIFIED_DATE_DESC\">Salesforce Mobile Trailblazer Community<\/a>.<\/li>\r\n<\/ul>\r\nTo learn more about Salesforce\u2019s mobile offerings, check out the <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.mobile_offline.meta\/mobile_offline\/intro.htm\">Mobile and Offline Developer Guide<\/a>.\r\n<h2><b>About the author<\/b><\/h2>\r\n<b>Ashwin Nair <\/b>is a<b> <\/b>Product Manager at Salesforce focused on Salesforce Mobile. He is currently working on mobile platform experiences and has been in the web and mobile development space for over seven years. Follow him on <a href=\"https:\/\/www.linkedin.com\/in\/ashwin-nair\/\">LinkedIn<\/a>.","post_title":"Introducing the BiometricsService Mobile Capability","post_excerpt":"The BiometricsService mobile capability enables developers to add additional security measures to the data being stored on LWCs.","post_status":"publish","comment_status":"open","ping_status":"closed","post_password":"","post_name":"introducing-the-biometricsservice-mobile-capability","to_ping":"","pinged":"","post_modified":"2025-11-05 02:13:27","post_modified_gmt":"2025-11-05 09:13:27","post_content_filtered":"","post_parent":0,"guid":"https:\/\/developer.salesforce.com\/blogs\/?p=201348","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw","featured_image":"<img width=\"1024\" height=\"538\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240429143606\/Single-Headshot-%E2%80%93-Light-1.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Introducing the BiometricsService Mobile Capability\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240429143606\/Single-Headshot-%E2%80%93-Light-1.png 1200w, https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240429143606\/Single-Headshot-%E2%80%93-Light-1-768x403.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/>","link":"https:\/\/developer.salesforce.com\/blogs\/2024\/04\/introducing-the-biometricsservice-mobile-capability","podcast_audio":{"audio_url":"","duration":""},"authors":[{"name":"Ashwin Nair","image_src":"https:\/\/secure.gravatar.com\/avatar\/1e6242e3f9fd391e0e9c61a52fa9bae3e8cfd36444ff402b1dfe843792de92b3?s=24&d=mm&r=g"}]}},{"post":{"ID":201632,"post_author":"3727","post_date":"2024-05-28 09:15:53","post_date_gmt":"2024-05-28 15:15:53","post_content":"Does your Salesforce implementation use third-party cookies, <code>iframe<\/code> elements, or AppExchange solutions? Google Chrome is phasing out third-party cookies and making changes to storage APIs, which may affect your org. To ensure that you\u2019re prepared, follow the testing methods recommended by Google and those outlined in this post, and take some time to review Salesforce updates that address Google\u2019s changes.\r\n<h2>What is the Privacy Sandbox?<\/h2>\r\nGoogle is improving privacy for its users through its <a href=\"https:\/\/developers.google.com\/privacy-sandbox\/overview\">Privacy Sandbox initiative<\/a>. Two key areas of focus are the <a href=\"https:\/\/developers.google.com\/privacy-sandbox\/3pcd\">blocking of third-party cookies<\/a> and the <a href=\"https:\/\/developers.google.com\/privacy-sandbox\/3pcd\/storage-partitioning\">enforcement of storage partitioning<\/a>. These updates reduce cross-site tracking and ensure that stored data is only accessible by the site that inserted the content.\r\n\r\n<span>For example, say that you visit <\/span>xyz.com<span>. Previously, if you clicked the \u201cAccept Cookies\u201d pop-up, a third-party advertiser could request and store data about your activity. Then, when you visited a different website with the same advertiser service, the third-party cookie could be used to serve you relevant ads based on your activity on xyz.com. <\/span>With the new privacy updates, Google Chrome recognizes when a request isn\u2019t coming from xyz.com, but instead from the third-party advertiser. Chrome then blocks the advertiser from accessing your activity data via a third-party cookie.\r\n\r\n<span>A similar concept applies to <\/span><a href=\"https:\/\/developers.google.com\/privacy-sandbox\/3pcd\/storage-partitioning#updated_apis\">storage and communication APIs<\/a><span> used in third-party contexts. For example, say that <\/span>you visit xyz.com, which stores data with the <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Web_Storage_API\">Web Storage API<\/a>.<span> Previously, because storage was unpartitioned, a site that embedded a page from xyz.com would have access to this data. With the new enforcement of storage partitioning,<\/span><span> the secondary site can\u2019t access the data from xyz.com.<\/span>\r\n\r\nTo gain a fuller understanding of the changes coming to Google Chrome, we highly encourage you to look through<a href=\"https:\/\/developers.google.com\/privacy-sandbox\/overview\"> Google\u2019s Privacy Sandbox documentation. <\/a>\r\n<h2>The Privacy Sandbox timeline<\/h2>\r\nPartitioned local and session storage rolled out in Chrome in Fall 2023. Third-party cookies, as of writing this blog post, have been disabled for 1% of users and should be disabled for all users by early 2025. To get up-to-date information, consult the <a href=\"https:\/\/privacysandbox.com\/open-web\/#the-privacy-sandbox-timeline\">Privacy Sandbox Timeline<\/a>.\r\n\r\n<img src=\"https:\/\/developer.salesforce.com\/blogs\/wp-content\/uploads\/2024\/05\/image-2024-05-28T090933.631-2000x612.png\" alt=\"A timeline chart for 2023-2025 showing that the third-party cookie deprecation process will end in the early months of 2025.\" width=\"968\" height=\"296\" class=\"alignnone wp-image-201633\" \/>\r\n<h2>Test Salesforce in Google Chrome<\/h2>\r\nAlmost every Salesforce org has been customized to some extent<span>\u2014<\/span>many with their own custom components or applications. So it\u2019s important for you to test all of your key scenarios within Chrome in the same way that it will function upon the rollout of Privacy Sandbox.\r\n<h3>Third-party cookies<\/h3>\r\nTo test your org without support for third-party cookies, enable the <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_salesforce_cookie_use_restrictions.htm&amp;release=250&amp;type=5\">Require first-party use of Salesforce cookies<\/a> setting in the My Domain setup page.\r\n\r\nFor more comprehensive testing of integrations with non-Salesforce systems, additionally adjust the flags in Chrome by going to the listed URL for each one in the table below and adjusting them to their corresponding values. For more on this, see <a href=\"https:\/\/www.google.com\/url?q=https:\/\/developers.google.com\/privacy-sandbox\/3pcd\/prepare\/test-for-breakage&amp;sa=D&amp;source=docs&amp;ust=1715650671841610&amp;usg=AOvVaw3V7V1kdrReJJRPSkvsnpU1\">Test for Breakage<\/a>, which includes Google\u2019s recommendations for testing sites without third-party cookies.\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td><b>Flag Name<\/b><\/td>\r\n<td><b>Flag ID &amp; URL<\/b><\/td>\r\n<td><b>Proposed Value<\/b><\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Tracking Protection for 3PCD<\/span><\/td>\r\n<td><code>chrome:\/\/flags#tracking-protection-3pcd<\/code><\/td>\r\n<td>enabled<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Test Third Party Cookie Phaseout<\/span><\/td>\r\n<td><code>chrome:\/\/flags#test-third-party-cookie-phaseout<\/code><\/td>\r\n<td>enabled<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Third-party Cookie Deprecation Trial Grants for Testing<\/span><\/td>\r\n<td><code>chrome:\/\/flags#third-party-cookie-deprecation-tria<\/code>l<\/td>\r\n<td>disabled<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Top-Level Third-Party Cookie Deprecation Trial Grants for Testing<\/span><\/td>\r\n<td><code>chrome:\/\/flags#top-level-third-party-cookie-deprecation-trial<\/code><\/td>\r\n<td>disabled<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Third-Party Cookie Deprecation Metadata Grants for Testing<\/span><\/td>\r\n<td><code>chrome:\/\/flags#tpcd-metadata-grants<\/code><\/td>\r\n<td>disabled<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Third-party Cookie Phase Out Facilitated Testing<\/span><\/td>\r\n<td><code>chrome:\/\/flags#tpc-phase-out-facilitated-testing<\/code><\/td>\r\n<td>default<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><span>Third-party Cookie Grants Heuristics Testing<\/span><\/td>\r\n<td><code>chrome:\/\/flags#tpcd-heuristics-grants<\/code><\/td>\r\n<td>disabled<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h3>Local and session storage<\/h3>\r\n<span>In Chrome 115, Google enforced storage partitioning in third-party contexts. Salesforce currently participates in Google\u2019s deprecation trial, which temporarily extends the use of unpartitioned storage on Salesforce domains. In Summer \u201924, Salesforce enables storage partitioning. For flexibility, you can use the new setting to opt out of Salesforce\u2019s rollout for now and keep unpartitioned storage until Google\u2019s deprecation trial permanently ends on September 3, 2024. After this date, Google Chrome storage partitioning is enabled regardless of the setting.<\/span>\r\n\r\n<span>To activate this setting, from Setup, in the Quick Find box, enter <\/span><i>User Interface<\/i><span>, and then select <\/span><b>User Interface<\/b><span>. Select <\/span><b>Disable Google Chrome Storage Partitioning for Salesforce Domains<\/b><span>, and then save your changes. Clear all browser cookies and browser history, and then close the browser. Log into Salesforce and ensure that all functionality works properly.<\/span>\r\n<h2>Recommended solutions<\/h2>\r\nIf you identify a problem during testing, it\u2019s important to first determine if you believe the issue to be with Salesforce, an AppExchange solution, or your own custom components.\r\n\r\nIf you believe the issue is due to Salesforce, contact <a href=\"https:\/\/help.salesforce.com\/s\/\">Salesforce support<\/a>. If it is with an AppExchange package, reach out to their recommended support channel. If it is with your own solution, then we have outlined some recommended solutions below.\r\n\r\nThe most common scenario in which you'll encounter issues is when an <code>iframe<\/code> in your Salesforce org hosts content from a cross-origin (or maybe third-party) domain (different than that in the address-bar URL) that tries to use cookies or local\/session storage APIs.\r\n<h3>Fetch data via REST APIs<\/h3>\r\nIf the solution that is not working is using storage for data, authentication, or state, this can normally be retrieved via our REST APIs via OAuth in a <a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.salesforce_developer_environment_dotnet_tipsheet.meta\/salesforce_developer_environment_dotnet_tipsheet\/salesforce_developer_environment_remoteaccess.htm\">connected app<\/a>. This is the route we took for Lightning Out as we needed the <code>iframe<\/code> to still exist, but we couldn\u2019t rely on the session ID cookie to be accessible since it would be stored on another origin.\r\n<h3>Remove the need for iframes<\/h3>\r\nAnother approach is to migrate anything that is being hosted on another origin and put it on the same origin. If you\u2019re using an <code>iframe<\/code> within Salesforce, consider migrating the solution into Salesforce when fetching the data and other resources. This way, you can still use storage paradigms on Salesforce because this access occurs on the same origin. When possible, we recommend migrating your content to Lightning Web Components. <a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/get-started-lwc.html\">See this getting started guide<\/a> to learn more.\r\n<h2>Salesforce\u2019s preparation for Privacy Sandbox changes<\/h2>\r\nSalesforce has enrolled in the deprecation trials for Privacy Sandbox so that we have greater control of the rollout. That way, if issues are found, we can address them quickly and keep you unblocked as much as possible. We will begin to remove these deprecation tokens starting with the <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.salesforce_release_notes.htm&amp;release=250&amp;type=5\">Summer \u201924 release<\/a> at a gradual but consistent pace. If you find an issue while you are testing your solutions, please reach out to <a href=\"https:\/\/help.salesforce.com\/s\/\">Salesforce support<\/a>.\r\n<h3>New Setup domain<\/h3>\r\nAnyone who has worked with Salesforce knows that Setup has been around for a <i>long<\/i> time. That said, many Setup pages include<code> iframe<\/code> content from other origins, and this breaks when third-party cookies are blocked by the browser. Since some of these pages are legacy, we found that the best solution to limit the potential impact was to move all Setup pages into a single My Domain-based salesforce-setup.com domain.\r\n\r\n<span>If your company controls users\u2019 or servers\u2019 access to the internet through firewalls or allowlists, your IT department must add <code>*.<\/code><\/span><code>salesforce-setup.com<\/code><span> to the company\u2019s list of allowed domains.<\/span>\r\n<h3>Lightning Out and token-based authentication<\/h3>\r\n<a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/lightning-out.html\">Lightning Out<\/a> is widely used, and so we introduced token-based authentication to handle authenticated scenarios across origins. If your solution requires any type of authenticated information from Salesforce, then <a href=\"https:\/\/developer.salesforce.com\/docs\/platform\/lwc\/guide\/lightning-out-third-party-cookies.html#enable-token-based-authentication\">enable Token-Based Authentication<\/a> in Session Settings and test your solution with cookies disabled.\r\n<h2><b>When will Salesforce\u2019s changes impact me?<\/b><\/h2>\r\n<b>Storage Partitioning: <\/b>Salesforce removes its deprecation tokens with the Summer \u201924 release.<span> At this point, storage partitioning is automatically enabled on Salesforce domains unless you use the setting described above for keeping unpartitioned storage until Google\u2019s deprecation trial permanently ends on September 3, 2024. <\/span>\r\n\r\n<b>New Setup Domain (*.<\/b><b>salesforce-setup.com)<\/b><b>: <\/b>A limited number of sandbox orgs already have the new setup domain enabled. The enablement resumes with a gradual rollout on June 15, 2024, after all customers are on the Summer \u201924 release. Salesforce plans to complete the rollout prior to the Winter \u201925 release.\r\n\r\n<b>Blocking of Third-Party Cookies: <\/b>Salesforce plans to automatically enable the <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_salesforce_cookie_use_restrictions.htm&amp;release=250&amp;type=5\">Require first-party use of Salesforce cookies<\/a> My Domain setting with a release update in the Winter \u201925 release, starting in August 2024 and concluding in October 2024. Salesforce plans to allow orgs to disable that setting in the event that functionality is impacted, but that setting is presently on track to effectively be forced on by Chrome after December 27, 2024.\r\n<h2>Conclusion<\/h2>\r\nGoogle\u2019s Privacy Sandbox initiative is a major step forward for modern web browser privacy. With the restrictions on third-party cookies and the enforcement of storage partitioning already underway, it\u2019s important that you\u2019re ready for these changes. Be sure to test your orgs, explore the recommended solutions, and check out the provided resources for more information.\r\n<h2>Resources<\/h2>\r\n<b>Summer \u201924 Release Notes<\/b>\r\n<ul>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_allow_setup_domain.htm&amp;release=250&amp;type=5\">Add the New Setup Domain<\/a><\/li>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_salesforce_cookie_use_restrictions.htm&amp;release=250&amp;type=5\">Prepare for Restrictions on Salesforce Cookie Use<\/a><\/li>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_third_party_storage_partitioning.htm&amp;release=250&amp;type=5\">Temporarily Opt Out of Google Chrome Storage Partitioning<\/a><\/li>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=release-notes.rn_general_salesforce_cookie_use_restrictions.htm&amp;release=250&amp;type=5\">Require first-party use of Salesforce cookies<\/a><\/li>\r\n<\/ul>\r\n<b>Knowledge Articles<\/b>\r\n<ul>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000578150&amp;type=1\">Understand How Google's Privacy Sandbox Initiative Impacts Salesforce<\/a><\/li>\r\n \t<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=001395243&amp;type=1\">New Setup Domain Rollout FAQ<\/a><\/li>\r\n<\/ul>\r\n<b>Chrome Resources<\/b>\r\n<ul>\r\n \t<li><a href=\"https:\/\/developers.google.com\/privacy-sandbox\/3pcd\/temporary-exceptions\/preserving-critical-user-experiences\">Privacy Deprecation Tokens<\/a>\r\n<ul>\r\n \t<li><a href=\"https:\/\/developer.chrome.com\/origintrials\/#\/view_trial\/3315212275698106369\">Trial for Third-Party Cookie Deprecation for Third-Party Embeds and Services<\/a><\/li>\r\n \t<li><a href=\"https:\/\/developer.chrome.com\/origintrials\/#\/view_trial\/-8517432795264450559\">Trial for DisableThirdPartyStoragePartitioning<\/a><\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<h2>About the authors<\/h2>\r\n<b>Greg Whitworth<\/b> is the Sr. Director of Product on the Salesforce Platform. You can follow him on <a href=\"https:\/\/twitter.com\/gregwhitworth\"><u>Twitter<\/u><\/a> and <a href=\"https:\/\/www.linkedin.com\/in\/gregwhitworth\/\"><u>LinkedIn<\/u><\/a>.\r\n\r\n<b>Chase Patterson<\/b> is a Senior Member of Technical Staff on the UI Services Customer Success Team.\r\n\r\n<b>Elaine Rose<\/b> is a Lead Technical Writer on the Domain Configuration team.\r\n\r\n<b>Jenna Bucien<\/b> is a Technical Writer on the Salesforce Platform.\r\n\r\n<b>Carolyn James<\/b> is an Engineering Program Manager within Platform.","post_title":"Prepare for the Google Chrome Privacy Sandbox Initiative","post_excerpt":"Google Chrome is phasing out third-party cookies and making changes to storage APIs, which may affect your org.","post_status":"publish","comment_status":"open","ping_status":"closed","post_password":"","post_name":"prepare-for-the-google-chrome-privacy-sandbox-initiative","to_ping":"","pinged":"","post_modified":"2025-11-05 02:13:18","post_modified_gmt":"2025-11-05 09:13:18","post_content_filtered":"","post_parent":0,"guid":"https:\/\/developer.salesforce.com\/blogs\/?p=201632","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw","featured_image":"<img width=\"1024\" height=\"538\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240603112707\/Codey-1.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Prepare for the Google Chrome Privacy Sandbox Initiative\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240603112707\/Codey-1.png 1200w, https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240603112707\/Codey-1-768x403.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/>","link":"https:\/\/developer.salesforce.com\/blogs\/2024\/05\/prepare-for-the-google-chrome-privacy-sandbox-initiative","podcast_audio":{"audio_url":"","duration":""},"authors":[{"name":"Chase Patterson","image_src":"https:\/\/secure.gravatar.com\/avatar\/3b9fa0730418c081902ab369b83911293f47d298067357f60a87407291aeee10?s=24&d=mm&r=g"},{"name":"Jenna Bucien","image_src":"https:\/\/secure.gravatar.com\/avatar\/0479b40a248be9382c20884e62357cea77f466877a0b2fbfcd26c0d52c8bee65?s=24&d=mm&r=g"}]}},{"post":{"ID":202391,"post_author":"3730","post_date":"2024-06-18 09:00:54","post_date_gmt":"2024-06-18 15:00:54","post_content":"<span style=\"font-weight: 400\">You developed your application and \u200cpassed the AppExchange Security review, and now your app is on the market. As you create great new features for your customers and make your solution more robust and complex, have the security concerns stopped? Definitely not! But there\u2019s nothing to worry about. Salesforce is here to help you with the rest of your journey into making great software by providing tools, tips, and tricks for your ongoing development.<\/span>\r\n<h2><span style=\"font-weight: 400\">Tools for checking for vulnerabilities in your code<\/span><\/h2>\r\n<span style=\"font-weight: 400\">The tools you used during your security review must continue to be used throughout the development lifecycle of your application. These include:<\/span>\r\n<ul>\r\n \t<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The <\/span><a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.packagingGuide.meta\/packagingGuide\/security_review_required_materials.htm\"><span style=\"font-weight: 400\">Checklist Builder<\/span><\/a><span style=\"font-weight: 400\"> will give you aspects of your solution that should be tested with each new release.\u00a0<\/span><\/li>\r\n \t<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">You\u2019ll gain much time and expertise by using the CLI scanner tool, <\/span><a href=\"https:\/\/developer.salesforce.com\/docs\/atlas.en-us.packagingGuide.meta\/packagingGuide\/security_review_code_analyzer_scan.htm\"><span style=\"font-weight: 400\">Salesforce Code Analyzer<\/span><\/a><span style=\"font-weight: 400\">, to find and mitigate vulnerabilities as they show up. (Note: bugs in the tool should be reported to the GitHub email.) There\u2019s also a <\/span><a href=\"https:\/\/forcedotcom.github.io\/sfdx-scanner\/en\/v3.x\/code-analyzer-vs-code-extension\/#:~:text=Run%20Code%20Analyzer%20via%20the,the%20AppExchange%20Security%20Review%20Wizard.\"><span style=\"font-weight: 400\">VS Code Beta version of the tool.<\/span><\/a><span style=\"font-weight: 400\"> And it can be used in conjunction with the retire.js engine for third-party code.<\/span><\/li>\r\n \t<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">After you complete your package and determine that it\u2019s ready to release, you must then run it against <\/span><a href=\"https:\/\/security.my.salesforce-sites.com\/sourcescanner\/SourceScannerHelp\"><span style=\"font-weight: 400\">Checkmarx<\/span><\/a><span style=\"font-weight: 400\">, which is provided to Partners in the <\/span><a href=\"https:\/\/security.my.salesforce-sites.com\/sourcescanner\/SourceScannerHelp\"><span style=\"font-weight: 400\">Partner Security Portal<\/span><\/a><span style=\"font-weight: 400\">. There you can schedule office hours with the Product Security team to get security best practices and ask implementation questions.<\/span><\/li>\r\n \t<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Don\u2019t forget to check your endpoints with web app scans. Those could be <\/span><a href=\"https:\/\/www.zaproxy.org\/\"><span style=\"font-weight: 400\">ZAP,<\/span><\/a> <a href=\"https:\/\/portswigger.net\/burp\/communitydownload\"><span style=\"font-weight: 400\">Burp<\/span><\/a><span style=\"font-weight: 400\"> (the most advanced on the market at the moment), or if you own the server you are scanning, <\/span><a href=\"https:\/\/security.my.salesforce-sites.com\/sourcescanner\/SourceScannerHelp\"><span style=\"font-weight: 400\">Chimera<\/span><\/a><span style=\"font-weight: 400\"> (also located in the Partner Security Portal).<\/span><\/li>\r\n<\/ul>\r\n<ul><\/ul>\r\n<span style=\"font-weight: 400\">Remember, tools do a good job of checking for standard programmatic vulnerabilities, so it\u2019s of utmost importance that you run manual testing and keep a running list of false positives from those tools. These can be very valuable later on in your development.<\/span>\r\n<h2><span style=\"font-weight: 400\">Best practices for continuous development<\/span><\/h2>\r\n<span style=\"font-weight: 400\">Salesforce recommends that you think about security early during your software development lifecycle and engage the security team early in the process. Running your scans is a great starting point for maintaining a secure application, but it\u2019s not all that you can do. Scanners give you a general idea of possible vulnerabilities, but they are limited, and some issues can only be spotted by manual testing of an application. That\u2019s why your security team should be engaged from the design phase through the release of a new feature.<\/span>\r\n\r\n<span style=\"font-weight: 400\">We advise you to elect a security champion on your development team that could spearhead the initial conversation about security with developers. This champion can be any developer interested in security and familiar with the code base, and in this role, they would prepare the ground for a smooth collaboration with the security teams inside your organization.<\/span>\r\n<h2><span style=\"font-weight: 400\">Establish repositories for the consistency of your code<\/span><\/h2>\r\n<span style=\"font-weight: 400\">The consistency of your code plays a key role in the success of your development efforts. To maintain a secure code development lifecycle, you must think about security together with the design and implementation of code. Creating and maintaining secure code development practices involves creating a repository of code that has secure patterns. This is useful for maintaining the enforcement of sharing and CRUD\/FLS, and to avoid things like injection attacks. Maintaining a code base of security best practices with reusable pieces of code saves developers time and ensures that vulnerabilities are not introduced by new patterns for solving known configuration issues. You should also check our <\/span><a href=\"https:\/\/developer.salesforce.com\/docs\"><span style=\"font-weight: 400\">developer documentation<\/span><\/a><span style=\"font-weight: 400\"> for updates to AppExchange policies and best practices.<\/span>\r\n<h2><span style=\"font-weight: 400\">Threat modeling<\/span><\/h2>\r\n<a href=\"https:\/\/trailhead.salesforce.com\/content\/learn\/modules\/threat-modeling-fundamentals\"><span style=\"font-weight: 400\">Threat modeling<\/span><\/a><span style=\"font-weight: 400\"> needs to be included in your development lifecycle design phase by your security team expert. This will help you gauge what are your most concerning pieces that could be entry points for vulnerabilities and attacks. Threat modeling is when you look at the architecture diagram and put on the attacker's hat; you look at the flow of the application and identify what are the weak links and how they could be exploited. This is not a deep exercise \u2014 you should only map the concerning areas, so developers can think of solutions to prevent possible attacks.<\/span>\r\n<h2><span style=\"font-weight: 400\">Check your code with scans<\/span><\/h2>\r\n<span style=\"font-weight: 400\">Before releasing your code to your customers, it\u2019s important to check that the code is secure and threat modeling was used to mitigate any possible vulnerabilities. This step is crucial if you want to protect your customers and maintain the security of your application. This is the time when you should engage the security team again to run a pen test of the feature.<\/span>\r\n\r\n<span style=\"font-weight: 400\">Don\u2019t forget to check that your libraries are up to date. You can use a scanner to list your libraries in use throughout the application and check against a <\/span><a href=\"https:\/\/cve.mitre.org\/\"><span style=\"font-weight: 400\">CVE database<\/span><\/a><span style=\"font-weight: 400\">. You can use tools like the ones cited on the <\/span><a href=\"https:\/\/owasp.org\/www-community\/Vulnerability_Scanning_Tools\"><span style=\"font-weight: 400\">OWASP website<\/span><\/a><span style=\"font-weight: 400\">, as well as <\/span><a href=\"https:\/\/github.com\/RetireJS\/retire.js\"><span style=\"font-weight: 400\">retire.js<\/span><\/a><span style=\"font-weight: 400\">, <\/span><a href=\"https:\/\/snyk.io\/\"><span style=\"font-weight: 400\">snyk.io<\/span><\/a><span style=\"font-weight: 400\">. You can also refer to the <\/span><a href=\"https:\/\/www.gartner.com\/reviews\/market\/application-security-testing\"><span style=\"font-weight: 400\">Gartner guide for app security tools<\/span><\/a><span style=\"font-weight: 400\">. The best practice at this point is to use SFCA with the retire.js engine for this. That\u2019s a good start to identifying vulnerabilities in third-party JavaScript.<\/span>\r\n<h2><span style=\"font-weight: 400\">Perform manual reviews<\/span><\/h2>\r\n<span style=\"font-weight: 400\">In a pen test, the security team will review the code and test the front end of the application to try to exploit it by creating unforeseen actions and gaining unauthorized access to protected data based on the user type used during testing.<\/span><span style=\"font-weight: 400\">\r\n<\/span><span style=\"font-weight: 400\">\r\n<\/span><span style=\"font-weight: 400\">Be sure to review the <\/span><a href=\"https:\/\/developer.salesforce.com\/blogs\/2023\/08\/the-top-20-vulnerabilities-found-in-the-appexchange-security-review\"><span style=\"font-weight: 400\">most common vulnerabilities that cause AppExchange security review failures<\/span><\/a><span style=\"font-weight: 400\">. You can also refer to OWASP's <\/span><a href=\"https:\/\/owasp.org\/API-Security\/editions\/2023\/en\/0x11-t10\/\"><span style=\"font-weight: 400\">top 10<\/span><\/a><span style=\"font-weight: 400\"> vulnerabilities for the part of your application that is external to Salesforce.<\/span>\r\n<h2><span style=\"font-weight: 400\">Conclusion<\/span><\/h2>\r\n<span style=\"font-weight: 400\">To uphold the value of trust, developers need to always take security measures and principles into consideration. This short guide provides a starting point for keeping security top of mind. Don\u2019t forget to check the links provided and think about security at every step of your development process. We\u2019ll provide more information on each of the points raised here in future posts.<\/span>\r\n<h2><span style=\"font-weight: 400\">Resources<\/span><\/h2>\r\n<ul>\r\n \t<li style=\"font-weight: 400\"><b>Trailhead:<\/b> <a href=\"https:\/\/trailhead.salesforce.com\/content\/learn\/modules\/secure-development-lifecycle\"><span style=\"font-weight: 400\">Secure Development Lifecycle<\/span><\/a><\/li>\r\n<\/ul>\r\n<h2><span style=\"font-weight: 400\">About the author<\/span><\/h2>\r\n<span style=\"font-weight: 400\" data-rich-links=\"{&quot;per_n&quot;:&quot;Richard Redditt&quot;,&quot;per_e&quot;:&quot;rredditt@salesforce.com&quot;,&quot;type&quot;:&quot;person&quot;}\">Richard Redditt<\/span> <span style=\"font-weight: 400\">is a Lead Security Review Operations Analyst on the AppExchange Ecosystem team. Over the past eight years, he\u2019s helped many companies go through the security review process. He has spoken at Dreamforce and provided guidance and best practices to partners building for the AppExchange.<\/span>","post_title":"Developing Securely for AppExchange","post_excerpt":"To uphold the value of trust, developers must always keep security top of mind, even after passing the AppExchange security review.","post_status":"publish","comment_status":"open","ping_status":"closed","post_password":"","post_name":"developing-securely-for-appexchange","to_ping":"","pinged":"","post_modified":"2025-11-05 02:13:12","post_modified_gmt":"2025-11-05 09:13:12","post_content_filtered":"","post_parent":0,"guid":"https:\/\/developer.salesforce.com\/blogs\/?p=202391","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw","featured_image":"<img width=\"1024\" height=\"538\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240617104410\/Digital-Tree-9.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Developing Securely for AppExchange\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240617104410\/Digital-Tree-9.png 1200w, https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/20240617104410\/Digital-Tree-9-768x403.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/>","link":"https:\/\/developer.salesforce.com\/blogs\/2024\/06\/developing-securely-for-appexchange","podcast_audio":{"audio_url":"","duration":""},"authors":[{"name":"Richard Redditt","image_src":"https:\/\/secure.gravatar.com\/avatar\/2c740b9e5a845cb44b112bcc1fd88e23d0a47c1d866993a43aad8187b5cc7fa1?s=24&d=mm&r=g"}]}}],"unstyled_content":"<p dir=\"ltr\">\n\t\t\t  <span >\n\t\t\t    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\" width=\"215\" height=\"322\" alt=\"\" \/>\n\t\t\t  <\/span>\n\t\t\tRemember your old campus job working in the school library or computer lab? The pay was OK and you got a bit of real world experience, but it didn\u2019t necessarily prepare you for life after school. You may have had a summer internship and it was fantastic, but it only lasted three months. Why not take the great experience you\u2019d get from a summer internship, skip that campus job and come work (remote is fine!) for the most <a href=\"http:\/\/www.forbes.com\/sites\/alexkonrad\/2014\/08\/20\/marc-benioffs-innovation-secret\/\">innovative company<\/a> in the world filled with some of the <a href=\"https:\/\/www.blackhat.com\/us-15\/speakers\/Hormazd-Billimoria.html\">best<\/a> <a href=\"https:\/\/appsecusa2015.sched.org\/event\/c52302496e4728340cca39edbced2aa1?iframe=yes&amp;w=i:100;&amp;sidebar=yes&amp;bg=no#?iframe=yes&amp;w=i:100;&amp;sidebar=yes&amp;bg=no\">security<\/a> <a href=\"https:\/\/www.blackhat.com\/us-15\/speakers\/Xiaoran-Wang.html\">technologists<\/a> you\u2019ll ever find.<\/p>\n<p dir=\"ltr\">The Women in TRUST group at salesforce.com is sponsoring a part-time security internship during the school year. Trust is salesforce.com\u2019s #1 value, and there is no shortage of opportunities that align with our vision.<\/p>\n<p dir=\"ltr\">The internships are open to all qualified college students. Salesforce.com is an equal opportunity employer and we\u2019re committed to diversity. Security as an industry can be a tough one to get into, and we\u2019d like to see all groups better represented. If you are interested in security and don\u2019t know where to start, this internship could be a good opportunity to get hands on experience in the field and expand your skill set.<\/p>\n<p dir=\"ltr\">If you or someone you know is interested, check out the link to the security internship role below. The position can be remote and we\u2019ll assign you an awesome mentor. So if you\u2019re a technology major with an interest in security &#8211; apply now! \u00a0We\u2019re looking to fill this internship role for the fall semester, so forget about that campus job and don\u2019t delay.<\/p>\n<p>\n\t\t\t  <span >\n\t\t\t    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Ch_114-security_kx7nff.jpg\" width=\"103\" height=\"103\" alt=\"\" \/>\n\t\t\t  <\/span>\n\t\t\t<\/p>\n<p dir=\"ltr\"><a href=\"http:\/\/careers.force.com\/jobs\/apex\/ts2__JobDetails?jobId=a1k70000002ZiiXAAS&amp;tSource=\">P<\/a><a href=\"http:\/\/careers.force.com\/jobs\/apex\/ts2__JobDetails?jobId=a1k70000002ZiiXAAS&amp;tSource=\">roduct Security Intern<\/a><span> &#8211; \u00a0Our Product Security team ensures the security of our products and serves as subject matter experts for our R&amp;D teams and AppExchange partners to protect our customers\u2019 data in today\u2019s rapidly evolving security landscape. We are a team of curious minds that specialize in security research, penetration testing, and innovative tool development. Many computer science students have expressed a desire to pursue a career in Security and our Trust Internship program hopes to bridge the gap between academic study and hands-on training in a corporate environment. The overall goal is to inspire these students to continue in the field.<\/span><\/p>\n\n","acf":{"canonicalid":"","language":"english","audio_url":"https:\/\/a.sfdcstatic.com\/developer-website\/blog-audio\/43061\/43061.mp3","hash":"bda39e64be5beb096984a738dfcd3465","transcription_id":"a81fedb4-3a19-480c-9ec5-b0c6a136f9fe","ready":true},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.3 (Yoast SEO v25.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Part-time Security Internship sponsored by Women in TRUST - Salesforce Developers Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Part-time Security Internship sponsored by Women in TRUST\" \/>\n<meta property=\"og:description\" content=\"Join the best security technologists at the most innovative company in the world, salesforce.com, for a fantastic part-time security internship.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust\" \/>\n<meta property=\"og:site_name\" content=\"Salesforce Developers Blog\" \/>\n<meta property=\"article:published_time\" content=\"2015-07-24T17:16:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-05T09:31:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\" \/>\n<meta name=\"author\" content=\"Astha Singhal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@astha_singhal\" \/>\n<meta name=\"twitter:site\" content=\"@SalesforceDevs\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Astha Singhal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust\",\"url\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust\",\"name\":\"Part-time Security Internship sponsored by Women in TRUST - Salesforce Developers Blog\",\"isPartOf\":{\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage\"},\"image\":{\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage\"},\"thumbnailUrl\":\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\",\"datePublished\":\"2015-07-24T17:16:21+00:00\",\"dateModified\":\"2025-11-05T09:31:07+00:00\",\"author\":{\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/6ad58205dec6ad7b0d0e7c1d575a78ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage\",\"url\":\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\",\"contentUrl\":\"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/developer.salesforce.com\/blogs\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Part-time Security Internship sponsored by Women in TRUST\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/#website\",\"url\":\"https:\/\/developer.salesforce.com\/blogs\/\",\"name\":\"Salesforce Developers Blog\",\"description\":\"Elevating developer skills and connecting with the Salesforce Developers community\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/developer.salesforce.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/6ad58205dec6ad7b0d0e7c1d575a78ee\",\"name\":\"Astha Singhal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/image\/3894af1b17a0092ee2ac83bd78816d3d\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/42c98b61f39dff5e0aa2b10279d22063cb359d6179ab310778a947cf27f671ad?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/42c98b61f39dff5e0aa2b10279d22063cb359d6179ab310778a947cf27f671ad?s=96&d=mm&r=g\",\"caption\":\"Astha Singhal\"},\"description\":\"Product Security Engineer@salesforce\",\"sameAs\":[\"https:\/\/x.com\/astha_singhal\"],\"url\":\"https:\/\/developer.salesforce.com\/blogs\/author\/asinghal\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Part-time Security Internship sponsored by Women in TRUST - Salesforce Developers Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust","og_locale":"en_US","og_type":"article","og_title":"Part-time Security Internship sponsored by Women in TRUST","og_description":"Join the best security technologists at the most innovative company in the world, salesforce.com, for a fantastic part-time security internship.","og_url":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust","og_site_name":"Salesforce Developers Blog","article_published_time":"2015-07-24T17:16:21+00:00","article_modified_time":"2025-11-05T09:31:07+00:00","og_image":[{"url":"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg","type":"","width":"","height":""}],"author":"Astha Singhal","twitter_card":"summary_large_image","twitter_creator":"@astha_singhal","twitter_site":"@SalesforceDevs","twitter_misc":{"Written by":"Astha Singhal","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust","url":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust","name":"Part-time Security Internship sponsored by Women in TRUST - Salesforce Developers Blog","isPartOf":{"@id":"https:\/\/developer.salesforce.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage"},"image":{"@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage"},"thumbnailUrl":"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg","datePublished":"2015-07-24T17:16:21+00:00","dateModified":"2025-11-05T09:31:07+00:00","author":{"@id":"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/6ad58205dec6ad7b0d0e7c1d575a78ee"},"breadcrumb":{"@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#primaryimage","url":"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg","contentUrl":"https:\/\/d259t2jj6zp7qm.cloudfront.net\/images\/c_scale%2Cw_215-DeathtoStock_SlowDown3_lowpua.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/developer.salesforce.com\/blogs\/engineering\/2015\/07\/security-internship-women-trust#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/developer.salesforce.com\/blogs"},{"@type":"ListItem","position":2,"name":"Part-time Security Internship sponsored by Women in TRUST"}]},{"@type":"WebSite","@id":"https:\/\/developer.salesforce.com\/blogs\/#website","url":"https:\/\/developer.salesforce.com\/blogs\/","name":"Salesforce Developers Blog","description":"Elevating developer skills and connecting with the Salesforce Developers community","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/developer.salesforce.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/6ad58205dec6ad7b0d0e7c1d575a78ee","name":"Astha Singhal","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/developer.salesforce.com\/blogs\/#\/schema\/person\/image\/3894af1b17a0092ee2ac83bd78816d3d","url":"https:\/\/secure.gravatar.com\/avatar\/42c98b61f39dff5e0aa2b10279d22063cb359d6179ab310778a947cf27f671ad?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/42c98b61f39dff5e0aa2b10279d22063cb359d6179ab310778a947cf27f671ad?s=96&d=mm&r=g","caption":"Astha Singhal"},"description":"Product Security Engineer@salesforce","sameAs":["https:\/\/x.com\/astha_singhal"],"url":"https:\/\/developer.salesforce.com\/blogs\/author\/asinghal"}]}},"jetpack_featured_media_url":"","authors":[{"name":"Astha Singhal","image_src":"https:\/\/secure.gravatar.com\/avatar\/42c98b61f39dff5e0aa2b10279d22063cb359d6179ab310778a947cf27f671ad?s=24&d=mm&r=g"}],"_links":{"self":[{"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/posts\/43061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/users\/1601"}],"replies":[{"embeddable":true,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/comments?post=43061"}],"version-history":[{"count":1,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/posts\/43061\/revisions"}],"predecessor-version":[{"id":190739,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/posts\/43061\/revisions\/190739"}],"wp:attachment":[{"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/media?parent=43061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/categories?post=43061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/tags?post=43061"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/developer.salesforce.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=43061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}