The lack of security around most Salesforce implementations is ridiculous.

That’s partially due to SF devs not knowing enough about the product but also due to Salesforce treating security as an afterthought.

For a poorly configured implementation it takes 2 web requests as an unauthenticated user to know all of the data you can pull down and then do it.

Don’t even get me started on the complete lack of monitoring. I basically had to design an entire security monitoring setup outside of Salesforce using their (absolutely awful) logs to get anything close to usable.

Edit: here’s a guide someone wrote. https://www.varonis.com/blog/misconfigured-salesforce-experi...

Seriously, you can automate this and then throw it at the end of recon to find SF sites. I’ve done it.