Topic starter
16/01/2026 3:14 pm
TL;DR: A misconfigured Salesforce setting can expose sensitive files through public links, and Obsidian Security says a majority of organisations still have the feature misconfigured despite the risk being flagged in 2024. The pattern shows that SaaS sharing controls fail when visibility, ownership, and remediation discipline are weak, not just when access is too broad.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Salesforce Misconfiguration Continues to Expose Links to the Public”.
Key questions
Q: What is the main failure mode when Salesforce public links expose files externally?
A: The failure mode is uncontrolled file sharing, where a legitimate collaboration feature creates public exposure without strong limits on who can share, how long the link stays active, or whether the file still needs to be public.
Q: Why do Salesforce public link misconfigurations create data exposure risk?
A: They create risk because external accessibility is tied to a user-facing setting rather than a tightly governed access workflow.
Q: What do security teams get wrong about SaaS file-sharing controls?
A: Teams often assume that enabling a sharing feature is enough, but the real issue is whether they can see, review, and remove every active exposure.
Practitioner guidance
- Restrict public-link entitlement scope Limit the Content Deliveries and Public Link capability to only the users who truly need external file sharing, and review profile and permission set assignments for that privilege.
- Enforce password and expiry controls Require passwords on externally shared files and make link expiration part of the default sharing process so that public links do not remain open indefinitely.
- Review all currently public files Search for files already shared via public links, confirm whether each one still has a valid business need, and remove the link where exposure is unnecessary.
Bottom line: Salesforce public links can turn a normal collaboration feature into an external exposure path when governance is weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:08 pm
Salesforce public-link exposure is a SaaS governance failure, not a single misclick. The security problem is that collaboration features are often deployed faster than the organisation can govern them. Once public sharing is available, the control boundary depends on visibility, user behaviour, and post-creation cleanup, all of which are uneven in many SaaS programmes. The practitioner implication is that file-sharing entitlements must be treated as an access lifecycle issue, not a one-time configuration task.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams control public file sharing in Salesforce?
A: Teams should treat public file sharing as a governed entitlement, not a convenience feature. Limit who can create links, require password protection and expiration, and review publicly shared files on a recurring schedule. The control must be enforced through policy and monitoring, because manual review alone will miss stale exposure.
👉 Read our full editorial: Salesforce public link misconfiguration exposes a SaaS governance gap