LWC Sensitive Object Field Import
Why is this an issue?
Importing sensitive fields directly into Lightning Web Components can expose personally identifiable information (PII) or other confidential data to the client-side. Fields marked as sensitive in your object metadata should be handled with care to prevent data leakage.
This rule detects when LWC controllers import fields via @salesforce/schema/ that are considered sensitive, based on the field's metadata classification or its name.
Examples
Example of incorrect code:
import { LightningElement } from 'lwc';
import NAME_FIELD from '@salesforce/schema/Contact.Name';
import SSN_FIELD from '@salesforce/schema/Contact.SSN__c';
export default class ContactViewer extends LightningElement {
// Sensitive fields exposed to client
}
Example of correct code:
import { LightningElement, wire } from 'lwc';
import getContactDetails from '@salesforce/apex/ContactController.getContactDetails';
export default class ContactViewer extends LightningElement {
// Sensitive data handled server-side with proper access controls
@wire(getContactDetails, { contactId: '$recordId' })
contact;
}
How can I fix violations?
Review whether the sensitive field needs to be exposed to the client
If the data is needed, access it through an Apex controller that enforces proper security checks
Consider using field-level security and sharing rules to control access
Remove the direct schema import if the field is not needed client-side
When should I disable this rule?
You may want to dismiss this issue if:
The field is marked sensitive but the data is not actually confidential in your context
You have implemented additional security controls that the rule cannot detect
The component is only used by administrators who should have access to all data
Resources