Security Concerns for the Salesforce Org

[monika-gupta-erudite]

@jongpie As I am trying to use this framework for one of the big organization I work for, I want to know, how secure is Nebula Logger as I have seen recommended way of installation is unmanaged way in your GitHub page. Basically I want to justify to my stakeholders, it is safe and secure to use.

[jongpie]

Hi @monika-gupta-erudite - apologies for the late response! I need to eventually make a wiki page with some more info around security, but I've tried to be very conscience of security when implementing Nebula Logger. A few examples:

• Nebula Logger is built 100% natively in Salesforce, so all of the code runs within your org. Similarly, all of Nebula Logger's data resides within your org.
• The data sharing model is private by default - users have to be granted access to logging data via permission sets before they can see any of the data. There are 4 permission sets included that provided various levels of access for different types of users & scenarios.
• It includes a built-in feature for data masking rules (configurable with the custom metadata type LogEntryDataMaskRule__mdt) to mask any sensitive data within your logs.
• Although Nebula Logger is not listed on AppExchange, it has been thoroughly reviewed (and improved) by dozens of Salesforce employees (myself included). All of the metadata is open source & freely available here in GitHub.
• By using the unlocked package, you have the ability to see and modify the source code directly in your org. In general, I don't think you should modify the code (it would make upgrades more difficult for you), but many Salesforce customers appreciate knowing that they have the ability, if they choose, to see & modify all of Nebula Logger's metadata.

Hope this helps! But please let me know if you have follow-up questions 👍