Preliminary research

Salesforce Apex Predator: Breaking Salesforce Sites

Nitay Bachrach and Cynthia Ardman · Reco

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

A Salesforce assessment workshop covering Aura and LWR discovery, bundled component analysis, Apex method and parameter tracing, SOQL/SOSL injection and GraphQL/UI-API exposure. Embedded field manuals and lab sequences turn route and data-access observations into practical testing workflows, with explicit guest-API permission prerequisites.

Record

Researcher

Nitay Bachrach and Cynthia Ardman

Published by

Reco

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• LWRed — Salesforce LWR Reconnaissance Tool Code
• lwred

Tags

• graphql
• rest-api
• javascript
• injection
• info-leak
• tooling
• case-study
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Nitay Bachrach and Cynthia Ardman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.