Secure by design doesn't mean secure by default

Organisations place enormous trust in SaaS platforms. Unlike self-hosted software, the assumption is that the vendor has handled security... and from a source-code exploitation standpoint, they're largely right. But this trust creates a dangerous blind spot: if the platform is secure, our deployment must be too. That assumption is wrong, and the data proves it.

This talk presents original research into SaaS platform misconfiguration risk across the Australian landscape, using Salesforce Experience Cloud (Lightning Communities) as the primary case study. Scanning 250 .com.au and .edu.au instances, we found that 56% were vulnerable to at least some degree of sensitive information disclosure. These were live, exploitable misconfigurations sitting in production environments across government, education, and enterprise.

The salesforce attack surfaces we identified fall into three categories. First, Salesforce objects exposed to unauthenticated guest users, allowing direct extraction of sensitive records through crafted API requests. Second, Apex controllers performing privileged actions such as record creation, modification, or data retrieval, that are reachable without proper authentication or authorisation checks. Third, self-registration flows that grant users authenticated sessions with overprivileged access, bypassing the access controls the organisation believes are in place.

Building on Google's release of the Aura Inspector tooling and extending the methodology further with custom reconnaissance techniques, the research demonstrates that the real risk in modern SaaS deployments is not a zero-day in the vendor's code. It is the configuration layer, the decisions made during implementation, customisation, and ongoing administration that creates exploitable gaps between a secure platform and an insecure deployment.

The talk will include live demonstrations of these attack paths against a purpose-built lab environment, walking attendees through examples of common SaaS misconfigurations. We will then contrast this gap with the IaaS and PaaS world, where Cloud Security Posture Management tooling like Microsoft Defender for Cloud already exists to detect equivalent issues. In the SaaS layer, comparable tooling is either immature or non-existent.

The session closes by examining the shared responsibility tension at the heart of this problem. SaaS platforms derive their value from extensibility and customisation, but more configurability means more opportunities to get it wrong. Should vendors prioritise secure defaults over flexibility? Where does vendor responsibility end and customer accountability begin? As organisations adopt increasingly customisable SaaS products, this risk only increases.