Catch a Real Vulnerability

Learning Objectives

After completing this unit, you'll be able to:

• Demonstrate how to use natural language prompts in Agentforce Vibes 2.0 to run a scan.
  
• Evaluate whether Code Analyzer identifies and resolves a violation.
  
• Compare a modified file against the original to determine exactly what broke.
  

Sign Up for a Developer Edition Org with Agentforce Vibes IDE

To complete this badge, you need a special, limited-time custom playground that contains the Agentforce Vibes IDE and our sample data.

1. Select Create Playground.
   
2. Your new org is automatically attached to your Trailhead account.
   
3. Make note of your org's expiration date and complete this badge before then.
   
4. Launch the playground.
   
5. Select Setup and select Agentforce Vibes.
   
6. On the Terms & Conditions window, select Accept.
   

Since you have to navigate back to your playground later, keep both tabs open. The first time you launch Agentforce Vibes it runs through a setup process that takes some time. You get the message: “Agentforce Vibes is loading…”

Badge Focus

This Developer Edition org has a limited number of Agentforce requests. Complete the steps in this badge before trying any custom prompts. Extra prompts might consume token limits and prevent you from finishing the project.

As the Salesforce Developer for AWC Computing, you need to create the CommissionRateUtil class to enforce the business rules for CalcPro sales.

• Junior: Earns 2.0% (0.02) commission on CalcPro sales
  
• Standard: Earns 2.5% (0.025) commission on CalcPro sales
  
• Senior: Earns 3.0% (0.03) commission on CalcPro sales
  

Here’s how to get started in Agentforce Vibes.

1. Select Agentforce Vibes in the Activity Bar.
   
2. Select the checkbox next to I agree to the terms.
   
3. Select Enable Agentforce.
   
4. Enter this prompt: Rename the default project to "AWC computing". Select Run.
   
5. Enter this prompt: Create an Apex class named CommissionRateUtil with commission rates 0.03, 0.025, and 0.02. Select Run.
   
6. Enter this prompt: Run Code Analyzer to detect security issues. Select Run.
   
7. Enter this prompt: Open the Apex class CommissionRateUtil.
   
8. At the end of the class, add this code snippet, which contains a SOQL vulnerability for demonstration purposes only:
   

 public static List<Account> findAccountsByName(String searchTerm) {
// HIGHLIGHT: dynamic SOQL is built from untrusted input here
String query = 'SELECT Id, Name FROM Account WHERE Name LIKE \'%' + searchTerm + '%\'';
return Database.query(query);
}

9. Select Run.
   
10. Enter this prompt: Run Code Analyzer to detect security issues.
    

11. Prompt Agentforce Vibes to fix the violation.
    
12. Rerun your scan prompt. The ApexSOQLInjection should be gone.
    
13. It’s time to deploy the Apex class with natural language. Prompt Agentforce Vibes to deploy the Apex class to your playground.
    

Congratulations! You have successfully used Code Analyzer and Agentforce Vibes to scan a live codebase, catch a high-severity security vulnerability, and apply a fix.