The document discusses upcoming security considerations for Lightning components. It emphasizes following contracts like encapsulation and using public interfaces to interact with other components. Components should be self-contained and not directly manipulate the DOM or lifecycles of other components. The framework lifecycle should also be respected, updating the DOM only in renderers and avoiding direct DOM access in controllers. Overall, components need to follow these guidelines to ensure they can safely and reliably integrate with other components without compromising the structure.

1. Spring ’16 Lightning
Updates for ISVs
March 15, 2016

2. Hosted by: ISV Technical Evangelist Team
Meet Your Speakers
Rodrigo ReboucasBill Mariani William Yeh Robert Sussland

3. Forward Looking Statements
Statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain forward-looking statements that involve
risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of the assumptions proves incorrect, the results of
salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking statements we make. All statements
other than statements of historical fact could be deemed forward-looking, including any projections of subscriber growth, earnings, revenues, or
other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any
statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services.
The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality
for our service, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth,
interruptions or delays in our Web hosting, breach of our security measures, the immature market in which we operate, our relatively limited
operating history, our ability to expand, retain, and motivate our employees and manage our growth, new releases of our service and
successful customer deployment, our limited history reselling non-salesforce.com products, and utilization and selling to larger enterprise
customers. Further information on potential factors that could affect the financial results of salesforce.com, inc. is included in our annual report
on Form 10-K for the fiscal year ended January 31, 2009 and our other filings. These documents are available on the SEC Filings section of the
Investor Information section of our Web site.
Any unreleased services or features referenced in this or other press releases or public statements are not currently available and may not be
delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently
available. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

4. What we plan to cover today
• Partner Community Updates
• Partner Alerts
• Spring ’16 Lightning Feature Highlights
• Lightning Inspector
• Security Review for Lightning Components
• Lightning Roadmap
• Question & Answer

5. Partner Community
Partner Community
• Partner Alerts
• News & Events
• Ask questions
• Share your best practices and
insights
• Collaborate with other partners
• Webinar Replays
• Pre-Release Details
For more information see: http://p.force.com/releases

6. Welcome to the Lightning Experience for ISVs Webinars
​ Watch the Replay of the Lightning Webinar Series
Defining Your Lightning Strategy as an ISV
Building and Releasing Components for ISVs
Migrating your Visualforce pages for Lightning Experience
For more information see: http://p.force.com/lightningready

7. 100+ Lightning-Ready Apps
LIGHTNING READY
For more information see the Lightning Ready Chatter Group

8. Q1
Feb/Mar/April
• March 15 – Hanover Partner Event @ CeBIT
March 14-18 – World Tour @ CeBIT
• March 23 – Chicago Partner Forum
March 24 – Chicago World Tour
• April 6 – Boston Partner Forum
April 7 – Boston World Tour
• April 11 – Melbourne Partner Forum
April 12 – Melbourne World Tour
• April 14 – Amsterdam World Tour
• April 28 – Washington DC World Tour
Q2
May/June/July
• May 5 – Toronto World Tour
• May 9 – Atlanta Partner Event
May 10-12 – Connections
• May 18 – London Partner Forum
May 19 – London World Tour
• May 24 – New York Partner Forum
May 25 – New York World Tour
Pre-register for
Dreamforce ’16
October 4 – 7
San Francisco, CA
Salesforce.com/events
Upcoming Partner Events
Upcoming: Chicago Partner Forum Event | Boston Partner Forum Event

9. Partner Alerts

10. Recent Partner Alerts
​ New Version of COA
​ AppExchange Listing Functionality Changes
​ New Version of LMA
​ Checkmarx Scan Improvements
​ Lightning Resources Access Check Message
​ New Org Limit for Environment Hub
​ Home Page Component Changes Update (Updated on December 18, 2015)
Alerts for Partners available in the Partner Community
For more information see: http://p.force.com/alerts

11. Access Level Enforcement in Lightning Components
Change
• In order for Lightning Components, Events and Interfaces to be accessible outside of their namespace - including App Builder - they
should be defined with ACCESS = “GLOBAL”.
• With Spring ‘16, we introduce access checks and display a warning in the browser console if you attempt to access a resource that
does not have ACCESS = “GLOBAL”.
• In Summer ‘16 we will enforce access checks and prevent access to resources outside of their namespace altogether, unless these
have been defined with ACCESS = “GLOBAL”.
Who is Impacted by this Change?
• Any partner building Lightning Component
Where to go for more information
• https://developer.salesforce.com/docs/atlas.en-us.200.0.lightning.meta/lightning/access_intro.htm
Lightning Components, Events and Interfaces Access Warning

12. Spring ‘16 Lightning Feature
Highlights

13. Environment Hub in LEX (GA)
Feature Overview
● Environment Hub available in Lightning
Experience
● Available in: Enterprise, Performance, and
Unlimited Editions
Key Capabilities
● Create/Manage Dev, Test, and Trial orgs in
new UI
● Lightning Experience/Salesforce Classic.

14. Customize Left Nav in LEX
Feature Overview
• Significantly improved navigation
• Fully customizable navigation menus
Key Capabilities
• Quick access to items
• Collapsible menu bar on left side of page
Value/Relevance to ISVs
• Admins can now customize the left nav to
highlight your App
• Creates navigation bars for profiles
• Lightning Page Tabs not Supported Tailor the left hand menu to each business
role and ensure focus on the most
important records for each function

15. URL custom button and links in LEX and SF1
Feature Overview
• Custom buttons and links that define their
content source as URL are now supported in
Lightning Experience and the Salesforce1
mobile app.
• This feature was previously available in
Salesforce Classic only.
Value/Relevance to ISVs
• This will help ISV apps containing these
buttons to become Lightning Ready.

16. Add VF pages to LEX nav bar
Feature Overview
• Add Visualforce Pages to the Lightning Experience
Navigation Menu
Key Capabilities
• Customize the Lightning Experience navigation menu by
adding Visualforce tabs. This capability already exists in
Salesforce Classic and the Salesforce1 mobile app. Now
you can do it in Lightning Experience.
• For details of how to customize the Lightning Experience
navigation menu, see Customize the Navigation
Experience for Lightning Experience Users elsewhere in
the release notes.
Value/Relevance to ISVs
• Partners can now issue instructions to customer admins to
include VF pages in the LEX nav bar.

17. Person Accounts in LEX (Beta)
Feature Overview
​ Person accounts take the standard business-to-business account model and extend it to include business-to-consumer
sales, so you can capture information about individual people with whom you do business. This feature was previously
unavailable in Lightning Experience.
Key Capabilities
​ With person accounts now available in Lightning Experience, Salesforce supports your sales process like never before.
This feature is available in both Lightning Experience and Salesforce Classic.
Value/Relevance to ISVs
​ Relevant for ISVs using Person Accounts in their application

18. Lightning Component Tokens (Developer Preview)
Feature Overview
​ You can reuse design tokens throughout your Lightning components CSS resources. Tokens make it easy to ensure
that your design is consistent, and even easier to update as your design evolves.
Key Capabilities
​ Standard Design Tokens
• Salesforce exposes a set of “base” tokens that you can access in your component style resources.
​ You can mix-and-match your tokens with the standard tokens.
​ Using tokens available from force:base allow you to mimic the look-and-feel of the Salesforce Lightning Design System
(SLDS) in your own custom components.
​ As the SLDS evolves, components that use the standard design tokens will evolve along with it.
Value/Relevance to ISVs
​ ISVs developing Lightning Components should play around with this feature to see how we're progressing in terms of
supporting their branding and dev efforts.
To add the standard tokens to your org, you extend your
org’s tokens bundle from the base tokens.

19. Styling and Branding
Use Lightning Design System styles or create your own
• Use standard tokens in your
components
• Create your own tokens
• Override standard tokens
• Brand your entire experience

20. Determine User Experience Context between Classic &
Lightning
Feature Overview
​ The User.UITheme and User.UIThemeDisplayed global variables and the
UserInfo.getUiTheme() and UserInfo.getUiThemeDisplayed() Apex utility
methods are improved to support the Salesforce1 mobile app and Lightning
Experience.
Key Capabilities
​ These existing variables and system calls have expanded the range of return
values to support the new user experience contexts.
​ These global variables and system calls can replace other, more fragile
methods of detecting the user experience context, such as testing for the
presence of the sforce.one
Value/Relevance to ISVs
​ ISVs can now build robust dynamic code to detect which user experience the
customer is running and update the UI accordingly.
Possible return values include
the following

21. Lightning App Builder - Desktop (Pilot)
Feature Overview
​ Editing Record Home - Open Pilot for DE Orgs
• Customize the layout of Record Homepages in LEX
• Rearrange standard components + standard/custom components on the
page.
• Self-service enabled for DE orgs; closed pilot for other orgs
​ Editing SFX Home - Limited Pilot
• Admins can customize the home screen of the Lightning Experience with
standard or custom Lightning Components.
​ New Standard Component: Tabs - Open Pilot for DE Orgs
• Admins can now add and customize a tab set on a Lightning Experience
page. Simply drop the Tabs component onto a page and modify tab
names, reorder, delete or even drop another component into a tab.
• This component is available as part of the Edit Record Home Pilot.
Value/Relevance to ISVs
• This gives new possibilities for the ISVs to create components for their
customers that, in the future, can be added by customers admins to the
SFX Home and the Record Homepages.

22. Lightning Out (Beta)
Feature Overview
• With the Spring ‘16 release, you can use Lightning Out (Beta) to
run your Lightning Components apps outside of Salesforce
Key Capabilities
• Whether it’s a Node.js app running on Heroku, a department
server inside the firewall, or even SharePoint (yes, SharePoint),
build your custom app with Force.com, and run it wherever your
users are.
Value/Relevance to ISVs
• ISV's can create components that can also be used to integrate
their SFDC App into other externally running platforms.
• This will create new opportunities for the ISVs.
Your Lightning Component that surfaces inside
another web application.

23. Lightning Inspector
Available now on Google Chrome Web Store

24. Lightning Inspector
Feature Overview
• Google Chrome DevTools extension that enables developers to
inspect Lightning Apps/Components
Key Capabilities
• Enables developers to navigate the component tree, inspect
component attributes, and profile component performance. The
extension also helps you to understand the sequence of event
firing and handling.
Value/Relevance to ISVs
• ISV's can use this plugin to get a better understanding of how
their app is performing.

25. Demo

26. Demo Recap
Spring ‘16 Demo Highlights
​ Lightning Inspector
​ Navigation Menus
​ Detect User Experience in Visualforce
​ Design Tokens

27. Security Update for Lightning
Components

28. Security Considerations
In Classic, Custom Visualforce pages could be beautiful creations
but...
• All Custom
• Isolated in their own frame
• Everyone does whatever they want
• No capability for customers to deeply integrate page in
new ways
How do you build on this?

29. Security Considerations
Why do Lightning Components work?
Contracts!
People are going to reuse your creation because
• Everyone can play together
• Everyone fits together
Follow the contract - don’t be the “out of spec” building block that causes the structure to crumble!
You have the right to break your own code - But not anyone else’s!

30. Contracts: Encapsulation
Your component should self-contained
​ Don’t read or write from the DOM of other components
​ Don’t pollute Window or Document.
​ Please don’t try to change the JS runtime by adding polyfills/modifying DOM methods

31. Contracts: Encapsulation
Your component should self-contained
​ Don’t read or write from the DOM of other components
​ Don’t pollute Window or Document.
​ Please don’t try to change the JS runtime by adding polyfills/modifying DOM methods
Ex, in a controller or renderer:
var
elems
=
$(‘my_class’);//
breaks
when
your
components
is
in
a
repeat
tag.
var
my_elems
=
$(cmp.getElement()).find(‘my_class’);
//
does
not
break

32. Contracts: Interact with components via public interfaces
When interacting with other components, interact via their shape
​ Use cmp.get() or cmp.set() to update attributes
​ Use component or app events (component events are preferred)
​ Use exported methods (aura:method)
​ Don’t hack the framework by using undocumented APIs
​ Don’t invoke the helper of another component. Only invoke exported methods.

33. Contracts: Interact with components via public interfaces
When interacting with other components, interact via their shape
​ Use cmp.get() or cmp.set() to update attributes
​ Use component or app events (component events are preferred)
​ Use exported methods (aura:method)
​ Don’t hack the framework by using undocumented APIs
​ Don’t invoke the helper of another component. Only invoke exported methods.
Example, in a controller:
var
another_cmp
=
cmp.find(‘foo’);
another_cmp.helper.doSomething();
//breaks
component
API
another_cmp.exported_method();
//does
not
break
API

34. Contracts: Framework Lifecycle
Respect the Framework Lifecycle
​ DOM is read only in a controller (and only read your own component’s DOM)
​ Do all DOM updates in a renderer (and don’t update another component’s
DOM)
​ Be careful to not update component state in a renderer
​ When interacting with the framework from outside the lifecycle, use getCallback()
​ To queue style changes in a controller, use $A.util.toggleClass(), or addClass(),
removeClass()
​ Recommended: learn and use the expression language whenever possible

35. Contracts: Framework Lifecycle
Respect the Framework Lifecycle
​ DOM is read only in a controller (and only read your own component’s DOM)
​ Do all DOM updates in a renderer (and don’t update another component’s
DOM)
​ Be careful to not update component state in a renderer
​ When interacting with the framework from outside the lifecycle, use getCallback()
​ To queue style changes in a controller, use $A.util.toggleClass(), or addClass(),
removeClass()
​ Recommended: learn and use the expression language whenever possible
Ex, in a controller:
myelem.style.visibility="hidden";//creates
a
race
condition
$A.util.addClass(myelem,my_style);
//OK,
if
style
defined,
or
move
to
a
renderer.

36. For Security Review
​ These rules must also be adhered to by any third party code you use.
• It is your responsibility to refactor third party libraries to get them to follow these rules
• Book an office hour to ask for help if needed!
​ Include unminified versions of all js static resources
​ Your security boundary cannot extend outside of your offering
• No “iframe loader” components, “html renderer” components, etc.
​ Avoid unsafe functions such as eval() (they will break when we tighten our CSP)
​ Avoid third party frameworks as they do both DOM rendering and event management in the
same process until we publish guides on how to integrate them safely with Lightning.
​ Follow the instructions in the Lightning Component Developer’s Guide

37. Security Review Information
Additional Resources:
http://p.force.com/security (Security Review training and information for partners)
https://developer.salesforce.com/page/Requirements_Checklist (Checklist)
https://developer.salesforce.com/page/Lightning_Security (List of issues with examples)
https://security.secure.force.com/security/contact/ohours (Free Office Hours)

38. Roadmap

39. Lightning Experience Roadmap
Summer ‘16
Winter ‘17
Enhanced Sales Productivity
Service UX Enhancements
Customization Enhancements
Sales Cloud Depth & Usability
Productivity & Intelligence
Service Cloud Depth
App Builder Customizations
Safe Harbor Applies – Make Purchasing Decisions on Currently Available Technology
Roadmap Items May Change at Any Time
Sales Cloud Depth
Enhanced Marketing Automation
Service Cloud
Expansion
AppExchange &
Ecosystem

40. Summer ‘16
● Packaging for record home pages for
standard and custom objects
● App Builder GA
● SLDS Design Tokens GA
● Eclipse IDE Support for Lightning
Components
● Visualforce for Lightning GA
● Locker Service for Lightning
Components
Lightning Roadmap
Winter ‘17
● Lightning Components bound by LMA
● Component Exchange with App Builder
● Build actions, buttons, links that fire
Lightning Components
● Lightning Components in Force.com
site w/ Guest User
● Initial version of Navigation
Future
• Automatic Restyling of VF pages
• LMA Lightning Enabled
• Salesforce standard Lightning
Components
• Lightning Data Service
• Navigation and Branding
• Lightning Extensions
• Developer Tools

41. Q&A

42. thank y u

43. Appendix

44. Global Actions in LEX Header
Feature Overview
▪ Multitasking with global actions and the new
composer window
Key Capabilities
▪ Global actions menu doesn’t disappear!
▪ Global actions spawns in composer windows on the
current page (LEX only)
▪ Easy note/activity creation without relation!
Value/Relevance to ISVs
▪ ISVs developing Global Actions can now provide
customer admins with instructions on how to make
these available in Lightning Experience

45. Security Review for Lightning Components
​ Lightning Component fail rate is much higher
• What ISVs need to watch out for and encourage good practices
• Where can ISVs go to for more help (links)
• Show the checklist for what is meant by adhere to the contract
​ 3rd party Javascript Frameworks are not supported
• Need to understand the Why
​ Javascript Libraries are supported if used properly
• Need to understand the differences
​ Locker Service?
​ Checkmark Scanner Changes?