Security best practices

[Peter Conijn (PeterConijn)]

With the rise of AI, it has become much easier to find and exploit vulnerabilities in AL. This makes it all the more important to raise awareness of best practices to secure sensitive data and enforce privacy standards for, for example, the European GDPR.

Examples of bad patterns I still see in AL:

• Credentials or API keys stored in table fields
• Credentials or API keys passed through procedures as Text variables instead of SecretText and/or NonDebuggable guards
• API keys or User SIDs sent to telemetry
• Process-determining fields modifyable in APIs without permission guards
• Crucial checks or validations being skippable through event subscription
• Personally identifyable information (PII) exposed through APIs without proper notice

Another area of interest is AI itself. As developers, we need to be aware of things like:

• Prompt injection, both direct and indirect
• Common vectors to manipulate AI like the Grandmother Attack
• Supply chain attack vectors (this is not exclusive to AI, but is a risk

I am by no means a security expert, but I would very much like to see this given more emphasis. What are your thoughts?

[Yahya Touil (yahyatouil-dev)]

I agree. Security should be considered across the whole data flow, not only where credentials are stored. Secrets can still leak through parameters, errors, telemetry, or debugging.

API exposure is another important area, especially for fields that can influence business processes or bypass validations.

With AI-assisted development becoming more common, reviewing generated code for permissions, data exposure, and validation bypasses is also important. A concise security checklist in the AL Best Practices would be very useful.