Insecure sharing to external users
Why is this an issue?
This rule identifies a Security vulnerability where sharing rules use "not equal" conditions when sharing data with external (portal) users. When a sharing rule operates on an opt-out basis (sharing occurs unless certain conditions are met), new records are shared by default. This can inadvertently expose sensitive data to external users.
For example, a rule that shares all accounts except those where Type != 'Internal' will automatically share any new account until someone explicitly sets its type to 'Internal'.
Examples
Example of incorrect configuration: A sharing rule that shares records unless they match specific criteria.
<SharingCriteriaRule>
<sharedTo>
<portalRole>ExternalPartners</portalRole>
</sharedTo>
<criteriaItems>
<field>Status__c</field>
<operation>notEqual</operation>
<value>Confidential</value>
</criteriaItems>
</SharingCriteriaRule>
Example of correct configuration: A sharing rule that explicitly defines which records should be shared.
<SharingCriteriaRule>
<sharedTo>
<portalRole>ExternalPartners</portalRole>
</sharedTo>
<criteriaItems>
<field>Status__c</field>
<operation>equals</operation>
<value>Public</value>
</criteriaItems>
</SharingCriteriaRule>
How can I fix violations?
Rewrite sharing rules to use positive matching (equals) rather than negative matching (not equal):
Identify exactly which records should be shared with external users.
Create criteria that explicitly match those records using
equalsconditions.Test thoroughly to ensure only intended records are shared.
Resources