Every Salesforce team I’ve worked with has a release checklist. Most of them cover deployment steps, test coverage, and rollback plans. Security review is often the item that gets a tick box with nobody actually looking. That’s how a permission set built for a pilot ends up granting “Modify All” to a profile with 200 users, three releases after anyone remembers why it was created.
I’ve sat in enough post-incident reviews to know the pattern. Nobody set out to expose sensitive fields to the wrong profile. It happened because a change that looked small in isolation, a new field, a cloned permission set, a flow running in system context, never got checked against what it actually opened up once it hit production.
Why security review keeps getting skipped
There are a few reasons, and they compound. It takes real judgment, not a script you run and read a green tick from. It doesn’t map neatly to a single owner either: the admin who built the permission set isn’t necessarily the person who understands the object’s data sensitivity, and the developer writing the Apex trigger isn’t necessarily thinking about who can invoke it. And it’s the easiest checklist item to defer when a release date is fixed and something else broke in UAT.
None of that makes it optional. It just means it needs a checklist specific enough to run in twenty minutes, not a vague instruction to “review security.”
What to actually check before you ship
Field-level security and object permissions
Any new or changed field needs an explicit answer to who can see it and who can edit it, not an assumption that the default profile settings are fine. Check every profile and permission set that touches the object, not just the ones you edited. It’s common for a field to get correctly locked down on the profile you were focused on and left wide open on three others nobody thought to check.
Sharing model changes
Organisation-wide defaults, sharing rules, and role hierarchy changes have a habit of solving one visibility problem while quietly creating another. If you’re moving an object from Public Read/Write to Private, walk through every automation, report, and integration that assumes broader visibility. I’ve seen a tightened sharing rule silently break an integration user’s access to records it needed to update, and the failure didn’t surface until a batch job started throwing errors two days later.
Apex running without sharing
Classes declared without sharing bypass the sharing model entirely, and that’s sometimes the right call. The problem is when it’s the default because nobody thought about it, not a decision. Same with SOQL and DML: check whether CRUD and field-level security are actually enforced in the code path, especially in anything invoked from a Lightning component or an exposed Apex REST endpoint. Security enforcement should show up somewhere in any query that touches user-facing data, not just the queries someone remembered to protect.
Integration and API surface
Every new connected app, named credential, and integration user is a new door into the org. Check the OAuth scopes granted are the minimum the integration actually needs, not whatever was easiest to get working in a sandbox. Check the integration user’s profile and permission sets against what the integration touches today, because it’s common for an integration user to accumulate access over eighteen months that has nothing to do with its current job.
Guest user access
If the release touches an Experience Cloud site, the guest user profile deserves its own pass, separate from everything else. Guest users are the one profile in most orgs where broad object access is a genuine security incident waiting to be reported, not a hypothetical. Salesforce has tightened defaults here over the last few releases, but a cloned profile or an older site can still be sitting on access nobody would approve if they saw it written down.
Flows and automation running in system context
A flow set to run in system context without sharing ignores both field-level security and the running user’s record access. That’s frequently the right choice for something like a data cleanup job. It’s the wrong choice, more often than teams expect, for a flow triggered from a screen a regular user interacts with, because it means the automation can read and write things that user couldn’t touch directly.
Where this actually goes wrong in practice
The releases that cause problems are rarely the big ones. Big releases get scrutiny by default: more eyes, more testing, a slower pace that leaves room to notice things. It’s the small release that skips review, the one field addition or the permission set clone done at 4pm on a Thursday to unblock a stakeholder, because it feels too minor to need it. Those are exactly the changes worth running through a fixed checklist, since a fixed checklist doesn’t care how small the change felt at the time.
Making this part of the release process, not an extra step
The checklist above works because it’s specific enough to run against a change in minutes, and specific enough that two different reviewers reach the same conclusion. Put it in the pull request template or the release notes, right next to test coverage. Assign it to whoever owns the release, not “the security team” as an abstract entity, because unowned checklist items are the ones that get skipped first when time runs short.
None of this needs new tooling. It’s a short, fixed set of questions applied consistently, every release, on every object and permission set the release touches. The org that does this quietly avoids the incident the org that doesn’t ends up explaining after the fact.