False Positives

Summary

ID	Rule	Severity	File	Status
FP-01	ApexCRUDViolation	High	ObjectTeamMemberTriggerHandler.cls	Suppressed — Trigger context
FP-02	ApexCRUDViolation	High	ObjectTeamMemberController.cls (TeamMemberSelector)	Suppressed — Intentional design
FP-03	ApexSOQLInjection	High	ObjectTeamMemberTriggerHandler.cls	False Positive — Safe source
FP-04	ApexSOQLInjection	High	ShareRecordQueueable.cls	False Positive — Whitelist
FP-05	ApexSOQLInjection	High	ObjectTeamMemberController.cls	False Positive — Safe source
FP-06	DebugStatements	Low	Multiple files	Accepted Risk

Detailed Explanations

FP-01: ApexCRUDViolation in ObjectTeamMemberTriggerHandler

Attribute	Value
File	ObjectTeamMemberTriggerHandler.cls
Line	Class level
Rule	ApexCRUDViolation
Severity	High
Status	Suppressed with @SuppressWarnings

Reason: This trigger handler runs in trigger context where CRUD permissions have already been validated by the calling controller (ObjectTeamMemberController). The handler performs system-level operations including auto-creating Owner records and managing share records, which require elevated access.

Mitigation: CRUD checks are enforced in ObjectTeamMemberController before any DML operation reaches the trigger.

---

FP-02: ApexCRUDViolation in TeamMemberSelector

Attribute	Value
File	ObjectTeamMemberController.cls
Line	129-150 (inner class)
Rule	ApexCRUDViolation
Severity	High
Status	Suppressed with @SuppressWarnings

Reason: The TeamMemberSelector inner class intentionally uses “without sharing” to allow users to view team members on records they have access to. This mirrors standard Salesforce AccountTeamMember behavior.

Mitigation: Users can only access this via LWC components on records they can already view. The recordId parameter comes from the UI context of an accessible record.

---

FP-03: ApexSOQLInjection in ObjectTeamMemberTriggerHandler

Attribute	Value
File	ObjectTeamMemberTriggerHandler.cls
Lines	135, 305
Rule	ApexSOQLInjection
Severity	High
Status	False Positive

Reason: The object name used in dynamic SOQL is derived from a Salesforce ID using the platform method Id.valueOf(actualRecordId).getSObjectType().getDescribe().getName(). This cannot be manipulated by users.

Code Pattern:

String objectName = Id.valueOf(actualRecordId)
    .getSObjectType().getDescribe().getName();
String query = 'SELECT OwnerId FROM '
    + String.escapeSingleQuotes(objectName)
    + ' WHERE Id = :actualRecordId';

Mitigation: Object name comes from Salesforce ID (not user input). Bind variables used for user-controlled values. Additional escaping applied as defense-in-depth.

---

FP-04: ApexSOQLInjection in ShareRecordQueueable

Attribute	Value
File	ShareRecordQueueable.cls
Lines	138-141, 163-167
Rule	ApexSOQLInjection
Severity	High
Status	False Positive

Reason: Share object names come from a hardcoded whitelist of standard objects or follow a deterministic pattern for custom objects.

Whitelist:

Map<String, String> standardShareObjects = new Map<String, String>{
    'Account' => 'AccountShare',
    'Contact' => 'ContactShare',
    'Case' => 'CaseShare',
    'Lead' => 'LeadShare',
    'Opportunity' => 'OpportunityShare',
    'Campaign' => 'CampaignShare',
    'Order' => 'OrderShare'
};

Mitigation: Object names validated against whitelist. Custom objects follow safe pattern (ObjectName__c -> ObjectName__Share). Bind variables used for all user-controlled values.

---

FP-05: ApexSOQLInjection in ObjectTeamMemberController

Attribute	Value
File	ObjectTeamMemberController.cls
Line	89
Rule	ApexSOQLInjection
Severity	High
Status	False Positive

Reason: Same as FP-03. Object name derived from Salesforce ID using platform API.

Mitigation: Object name from Id.getSObjectType().getDescribe().getName(). Cannot be spoofed. Bind variable used for record ID.

---

FP-06: DebugStatements

Attribute	Value
Files	ObjectTeamMemberTriggerHandler.cls, ShareRecordQueueable.cls, ExpiredTeamMemberCleanupBatch.cls
Rule	DebugStatements
Severity	Low
Status	Accepted Risk

Reason: Debug statements are retained for production troubleshooting. They log only at ERROR/WARN levels and contain no sensitive data.

Content logged: Exception messages, record counts, job status information.

Mitigation: Debug output can be filtered via Salesforce Debug Log settings. No PII or credentials logged.

Security Controls Summary

Control	Status	Implementation
CRUD checks in controllers	Implemented	isAccessible(), isCreateable(), isUpdateable(), isDeletable()
FLS enforcement	Implemented	Permission Sets control field access
SOQL injection prevention	Implemented	Bind variables for user input, whitelist for object names
Sharing model	Implemented	with sharing on controllers, without sharing only where documented
Input validation	Implemented	Null checks, format validation, business rules
XSS prevention	Implemented	LWC framework handles output encoding

External Integrations

Check	Result
HTTP Callouts	None — package makes no external calls
Named Credentials	Not used
External Objects	Not used
Remote Site Settings	Not required