@raishin/vanguard-frontier-agentic 2.3.0 → 2.5.0

package/skills/salesforce/salesforce-devsecops-pipeline-skill/references/sandbox-masking-strategy.md

@@ -0,0 +1,193 @@
+# Sandbox Masking Strategy Reference
+
+Guidelines for data masking in Salesforce sandboxes to protect PII, PHI, and
+regulated data when refreshing from production.
+
+---
+
+## Why Masking Is Required
+
+Sandbox environments are used by developers, QA engineers, ISV partners, and
+consultants who typically should not access production customer data. Without
+masking:
+
+- PII violations under GDPR, CCPA, HIPAA, and similar regulations.
+- Breach notification obligations if sandbox data is exposed.
+- SOC 2 Type II non-conformance in access control controls.
+
+Salesforce Sandbox Data Masking
+is a licensed add-on product
+(part of Salesforce Shield or available separately) that automates masking
+during sandbox refresh. Orgs without the add-on must implement a post-refresh
+masking flow.
+
+---
+
+## Classify Data Before Masking
+
+### Classification Tiers
+
+| Tier | Description | Masking Requirement |
+|------|-------------|---------------------|
+| Public | No restriction | Not required |
+| Internal | Business-sensitive, no regulatory constraint | Pseudonymization recommended |
+| Confidential | PII (name + email + phone when combined) | Mask or anonymize |
+| Restricted | Financial data, account numbers, SSN/NI | Must mask or delete |
+| Regulated | PHI (HIPAA), SPI (CCPA), special categories (GDPR) | Must mask; prefer deletion |
+
+### Common Salesforce Fields by Tier
+
+| Object | Field | Classification |
+|--------|-------|----------------|
+| Contact | Email | Confidential |
+| Contact | Phone, MobilePhone | Confidential |
+| Contact | MailingStreet + MailingCity | Confidential (combined) |
+| Contact | SSN__c (custom) | Restricted |
+| Account | BillingAddress | Internal |
+| Lead | Email, Phone | Confidential |
+| Individual | IndividualId | Restricted |
+| HealthCloudGA__EhrPatient__c | All fields | Regulated (PHI) |
+| FinServ__FinancialAccount__c | FinServ__Balance__c | Restricted |
+
+---
+
+## Masking Techniques
+
+### 1. Deterministic Pseudonymization
+
+Replace PII with a consistent synthetic value derived from a hash. Same input
+always produces the same synthetic output, allowing relational integrity to be
+maintained (foreign key lookups still work).
+
+```apex
+// Example: SHA-256-based email pseudonymization
+public static String pseudonymizeEmail(String realEmail, String salt) {
+    Blob hash = Crypto.generateDigest('SHA-256',
+        Blob.valueOf(salt + realEmail.toLowerCase));
+    String hex = EncodingUtil.convertToHex(hash).left(12);
+    return hex + '@masked.example.com';
+}
+```
+
+Use this when sandbox tests require consistent email across related records
+(e.g., Contact.Email and Case.SuppliedEmail must match).
+
+### 2. Randomization
+
+Replace values with random synthetic data. Breaks relational integrity but is
+simpler and sufficient for fields not used as join keys.
+
+```apex
+public static String randomEmail {
+    String chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    String localPart = '';
+    for (Integer i = 0; i < 8; i++) {
+        localPart += chars.charAt((Integer)(Math.random * chars.length));
+    }
+    return localPart + '@example-masked.org';
+}
+
+public static String randomPhone {
+    // Format: +1-555-RANDOM where RANDOM is 7 digits
+    Integer suffix = (Integer)(Math.random * 9000000) + 1000000;
+    return '+1-555-' + String.valueOf(suffix);
+}
+```
+
+### 3. Nullification (Field Blanking)
+
+Set sensitive fields to null. Simplest approach; use for fields that are not
+required by sandbox tests.
+
+```apex
+List<Contact> contacts = [SELECT Id, SSN__c, CreditCardNumber__c FROM Contact LIMIT 10000];
+for (Contact c : contacts) {
+    c.SSN__c = null;
+    c.CreditCardNumber__c = null;
+}
+Database.update(contacts, false);
+```
+
+### 4. Value Substitution with Realistic Patterns
+
+Replace with realistic-looking but clearly fake data, useful for UI testing.
+
+```apex
+// Names from a fixed list clearly labeled as fake
+static final List<String> FAKE_FIRST_NAMES = new List<String>{
+    'TestFirst', 'SampleFirst', 'DemoFirst', 'FakeFirst'
+};
+static final List<String> FAKE_LAST_NAMES = new List<String>{
+    'TestLast', 'SampleUser', 'DemoContact', 'MaskedRecord'
+};
+```
+
+---
+
+## Regulated-Vertical Considerations
+
+### Healthcare (HIPAA)
+
+HIPAA Safe Harbor requires 18 specific identifiers to be removed or masked:
+- Names, geographic data below state level, all date elements (except year),
+  phone, fax, email, SSN, account numbers, license numbers, VINs, device
+  identifiers, URLs, IPs, biometric identifiers, full-face photos, and any
+  other unique identifying numbers.
+
+In Salesforce Health Cloud
+:
+- `HealthCloudGA__EhrPatient__c` — delete all records or use fully synthetic patients.
+- `HealthCloudGA__ClinicalEncounter__c` — delete or replace with synthetic.
+- Custom PHI fields on standard objects — apply nullification or pseudonymization.
+
+### Financial Services (GLBA / PCI-DSS)
+
+- `FinServ__FinancialAccount__c`.`FinServ__Balance__c` — randomize to non-zero
+  dummy values (zero balances may cause test logic failures).
+- Payment card data must NEVER appear in sandbox. Salesforce org-level
+  encryption and payment masking add-ons should prevent this from flowing in.
+
+### GDPR / CCPA
+
+Data subject rights requests apply to sandbox data if the sandbox contains
+identifiable individuals. Masking eliminates this obligation for the sandbox.
+
+---
+
+## Post-Refresh Masking Execution Pattern
+
+```
+1. Sandbox refresh completes (new sandbox copy of production).
+2. System Administrator runs masking Apex batch before granting access to sandbox.
+3. Masking batch processes records in chunks of 200.
+4. Masking audit record created: timestamp, operator, object counts masked.
+5. Access granted to sandbox users only after masking audit record is created.
+```
+
+### Masking Sequence (dependency order)
+
+Mask in this order to avoid foreign key constraint issues:
+
+1. `Individual` object (master PII record)
+2. `Contact` (linked to Individual)
+3. `Lead`
+4. `User` (non-system-admin users)
+5. `Case` (SuppliedEmail, SuppliedName)
+6. `CaseComment` (CommentBody may contain PII)
+7. Custom regulated objects
+
+---
+
+## Sandbox Masking Checklist
+
+- [ ] All production-refresh sandboxes have a masking job configured.
+- [ ] Masking job runs automatically on refresh via Automation tool or manual
+  post-refresh runbook.
+- [ ] Sandbox access is blocked (login disabled or IP restricted) until masking
+  job completes.
+- [ ] Custom PII fields on standard objects are included in masking scope.
+- [ ] External connected app credentials stored in Auth. Providers are rotated
+  post-refresh (they are copied from production but should not be active in sandbox).
+- [ ] Outbound email is disabled in sandbox (Setup > Deliverability: System Email
+  Only) to prevent real emails reaching real customers.
+- [ ] Named Credential endpoints are pointed to sandbox/mock counterparts.

package/skills/salesforce/salesforce-devsecops-pipeline-skill/references/sca-rule-catalog.md

@@ -0,0 +1,226 @@
+# SCA Rule Catalog Reference
+
+Static code analysis rules for Apex (PMD), Lightning Web Components (ESLint),
+and JavaScript dependency scanning (RetireJS / npm audit) in Salesforce DevSecOps pipelines.
+
+---
+
+## PMD Rules for Apex
+
+PMD is the standard static analysis tool for Apex. Rules are organized by
+severity. The Salesforce DX CLI plugin `@salesforce/plugin-code-analyzer`
+wraps PMD and can run these checks in pipeline steps.
+
+### Critical Rules (block merge)
+
+| Rule | Category | What It Catches |
+|------|----------|----------------|
+| `AvoidDmlStatementsInLoops` | Performance | DML inside for/while loops |
+| `AvoidSoqlInLoops` | Performance | SOQL inside for/while loops |
+| `ApexCRUDViolation` | Security | Missing object/field CRUD checks before DML |
+| `ApexSharingViolations` | Security | Classes without `with sharing` declaration |
+| `ApexSOQLInjection` | Security | Dynamic SOQL concatenation with user input |
+| `ApexXSSFromURLParam` | Security | URL parameter inserted into page output |
+| `ApexOpenRedirect` | Security | User-controlled redirect targets |
+
+### High Rules (flag for review)
+
+| Rule | Category | What It Catches |
+|------|----------|----------------|
+| `AvoidGlobalModifier` | Best Practice | Global scope on classes/methods |
+| `ExcessiveClassLength` | Design | Classes > 1000 lines |
+| `ExcessiveMethodLength` | Design | Methods > 100 lines |
+| `CyclomaticComplexity` | Design | Complexity > 10 in a method |
+| `NcssMethodCount` | Design | Non-comment source statements > 40 |
+| `EmptyCatchBlock` | Error Prone | `catch(Exception e) {}` swallows errors |
+| `EmptyStatementBlock` | Error Prone | Empty if/try/catch blocks |
+| `AvoidHardcodingId` | Best Practice | 15/18-char Salesforce IDs in code |
+| `UnusedLocalVariable` | Best Practice | Variables declared but never read |
+| `OperationWithLimitsInLoop` | Performance | Limits checks inside loops |
+
+### Medium Rules (advisory)
+
+| Rule | Category | What It Catches |
+|------|----------|----------------|
+| `DebugsShouldUseLoggingLevel` | Best Practice | `System.debug` without LoggingLevel |
+| `ApexDoc` | Documentation | Public methods without ApexDoc comments |
+| `OneDeclarationPerLine` | Code Style | Multiple variable declarations on one line |
+| `FieldDeclarationsShouldBeAtStart` | Code Style | Fields declared mid-class |
+
+### Running PMD in CI
+
+```bash
+# Salesforce Code Analyzer CLI plugin
+sf scanner run \
+  --target "force-app/main/default/classes/**/*.cls" \
+  --engine pmd \
+  --ruleset "category/apex/security.xml,category/apex/performance.xml" \
+  --severity-threshold 2 \
+  --format csv \
+  --outfile scan-results.csv
+
+# Exit code > 0 if violations at or above threshold
+```
+
+Custom ruleset XML for project-specific exclusions:
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<ruleset name="Project Custom Ruleset"
+  xmlns="http://pmd.sourceforge.net/ruleset/2.0.0">
+  <description>Project-specific PMD configuration</description>
+  <rule ref="category/apex/security.xml">
+    <exclude name="ApexSuggestUsingNamedCredential"/> <!-- named creds not yet available -->
+  </rule>
+  <rule ref="category/apex/performance.xml"/>
+</ruleset>
+```
+
+---
+
+## ESLint Rules for LWC
+
+The `@salesforce/eslint-config-lwc`
+package provides recommended rules.
+
+### Security-Critical ESLint Rules
+
+| Rule | Severity | What It Catches |
+|------|----------|----------------|
+| `no-eval` | Error | Dynamic code execution via `eval` |
+| `no-implied-eval` | Error | `setTimeout('string')` patterns |
+| `no-inner-declarations` | Error | Functions declared inside blocks |
+| `@locker/locker/distorted-xml-http-request-never-use-inner-html` | Error | XSS via innerHTML |
+| `@salesforce/lwc/no-document-query` | Error | `document.querySelector` bypassing shadow DOM |
+
+### LWC-Specific Rules
+
+| Rule | Severity | What It Catches |
+|------|----------|----------------|
+| `@salesforce/lwc/no-api-reassignments` | Error | Mutating `@api` properties directly |
+| `@salesforce/lwc/no-deprecated` | Warning | Deprecated LWC APIs |
+| `@salesforce/lwc/no-leading-uppercase-api-name` | Error | API naming violations |
+| `@salesforce/lwc/no-template-children` | Error | Accessing `this.template.children` |
+| `@salesforce/lwc/consistent-component-name` | Warning | File name / class name mismatch |
+
+### ESLint Configuration (`.eslintrc.json`)
+
+```json
+{
+  "extends": ["@salesforce/eslint-config-lwc/recommended"],
+  "rules": {
+    "no-eval": "error",
+    "no-implied-eval": "error",
+    "@salesforce/lwc/no-document-query": "error"
+  },
+  "overrides": [
+    {
+      "files": ["**/__tests__/**"],
+      "rules": {
+        "@salesforce/lwc/no-document-query": "off"
+      }
+    }
+  ]
+}
+```
+
+### Running ESLint in CI
+
+```bash
+# Install
+npm install --save-dev @salesforce/eslint-config-lwc
+
+# Run
+npx eslint force-app/main/default/lwc \
+  --ext .js \
+  --format json \
+  --output-file eslint-results.json
+
+# Non-zero exit if errors found
+```
+
+---
+
+## RetireJS / npm audit CVE Patterns
+
+### RetireJS
+
+RetireJS scans JavaScript files and `package.json` for known vulnerable
+library versions by comparing against a CVE database.
+
+```bash
+# Install
+npm install -g retire
+
+# Scan a project
+retire --path force-app/main/default/staticresources \
+  --outputformat json \
+  --outputpath retire-results.json \
+  --severity medium  # fail on medium and above
+```
+
+Common vulnerable patterns found in Salesforce static resources:
+
+| Library | Common Issue | Safe Version Floor |
+|---------|-------------|-------------------|
+| jQuery | `$.parseHTML` XSS, `$` selector injection | >= 3.5.0 |
+| Moment.js | ReDoS in `moment.format` | >= 2.29.4 (or migrate to Luxon) |
+| Handlebars.js | Prototype pollution | >= 4.7.7 |
+| Lodash | Prototype pollution via `merge`/`defaultsDeep` | >= 4.17.21 |
+| Underscore.js | Prototype pollution | >= 1.13.0 |
+
+### npm audit
+
+```bash
+# For projects with package.json (e.g., SFDX project tools, Jest setup)
+npm audit --audit-level=moderate --json > npm-audit-results.json
+
+# Fail CI pipeline on high/critical
+npm audit --audit-level=high
+```
+
+---
+
+## Pipeline Integration Reference
+
+### GitHub Actions example
+
+```yaml
+name: SCA Gate
+on: [pull_request]
+jobs:
+  sca:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install Salesforce CLI
+        run: npm install -g @salesforce/cli
+      - name: Install Code Analyzer
+        run: sf plugins install @salesforce/plugin-code-analyzer
+      - name: Run PMD
+        run: |
+          sf scanner run \
+            --target "force-app/**/*.cls" \
+            --engine pmd \
+            --severity-threshold 2 \
+            --format github-actions
+      - name: Run ESLint
+        run: |
+          npm ci
+          npx eslint force-app/main/default/lwc --ext .js
+      - name: RetireJS
+        run: |
+          npm install -g retire
+          retire --path force-app/main/default/staticresources --severity high
+```
+
+### Severity Threshold Guidance
+
+| Pipeline Stage | Recommended Threshold |
+|---------------|----------------------|
+| Pull Request (feature branch) | Fail on Critical; Warn on High |
+| Merge to main/develop | Fail on Critical and High |
+| Production deployment | Fail on Critical, High, and Medium |