The Graveyard

50 Salesforce Mistakes I Made So You Don't Have To

10+ years. 85 production releases. Every mistake documented so you can skip the pain.

50 mistakes • Ranked by severity • Searchable • With code examples

50 mistakes found

#1🔄 FlowsCareer-Ending

The Infinite Flow Loop That Ate Production

Record-triggered flow updates the same object. Flow fires again. And again. And again.

Read the war story

#2🔄 FlowsPainful

Get Records Inside a Loop: The Governor Limit Speedrun

Put a Get Records element inside a loop. Hit 100 SOQL queries on the 101st record.

Read the war story

#3🔄 FlowsAnnoying

The Flow With No Fault Path (Enjoy Your Cryptic Error)

Deployed a screen flow with no fault handling. Users got 'An unhandled fault has occurred' and I got 50 support tickets.

Read the war story

#4🔄 FlowsPainful

Hardcoded Record IDs in Flows: The Sandbox Surprise

Hardcoded a Record Type ID in a flow. Deployed to production. Different ID. Everything broke.

Read the war story

#5🔄 FlowsRookie

Using After-Save When Before-Save Would Do

Built an after-save flow to update the triggering record. Wasted a DML operation on every single save.

Read the war story

#6⚡ ApexCareer-Ending

SOQL Query Inside a For Loop (The Classic)

Wrote a SOQL query inside a for loop. 200 records came in. 200 queries fired. Governor said no.

Read the war story

#7⚡ ApexPainful

Test Class That Only Tests One Record

Wrote a test class that inserted 1 record. Got 100% coverage. Deployed. Trigger failed on bulk operations.

Read the war story

#8⚡ ApexAnnoying

Mixed DML: Setup and Non-Setup Objects in the Same Transaction

Inserted a User and an Account in the same transaction. Salesforce said absolutely not.

Read the war story

#9⚡ ApexPainful

All Logic in the Trigger Body (No Handler Class)

Wrote 300 lines of logic directly in the trigger. Six months later, nobody could maintain it. Including me.

Read the war story

#10⚡ ApexRookie

Flying Blind Without the Limits Class

Never checked Limits.getQueries() in my code. Hit governor limits in production with zero warning.

Read the war story

#11🗄️ DataCareer-Ending

Mass Update With No Backup: The 'Undo' Button That Doesn't Exist

Ran a mass update on 50,000 records without exporting them first. Client asked to revert. I had nothing.

Read the war story

#12🗄️ DataPainful

No Duplicate Rules: 14,000 Duplicate Accounts Later

Launched an org without duplicate matching rules. Users created duplicates for a year. Cleanup took three months.

Read the war story

#13🗄️ DataPainful

Hard Delete When Soft Delete Would Do

Used Hard Delete in Data Loader. Records bypassed the Recycle Bin. Permanent deletion. No recovery.

Read the war story

#14🗄️ DataCareer-Ending

Data Loader Pointed at Production Instead of Sandbox

Forgot to check the Sandbox checkbox. Updated 30,000 records in production instead of sandbox.

Read the war story

#15🗄️ DataAnnoying

10,000 Records Pointing to One Parent: Hello, Lock Errors

Put 10,000 child records under one Account. Every bulk operation got UNABLE_TO_LOCK_ROW errors.

Read the war story

#16🏗️ ArchitectureCareer-Ending

5 Process Builders, 3 Flows, 2 Triggers on One Object

Stacked automations from three different consultants over two years. Nobody knew what fired when.

Read the war story

#17🏗️ ArchitectureAnnoying

Building Custom Objects When Standard Objects Already Exist

Built a custom Project_Tracker__c object. Turns out Salesforce has a perfectly good Task and Event system.

Read the war story

#18🏗️ ArchitecturePainful

Hardcoded Config Values Instead of Custom Metadata Types

Hardcoded thresholds, API endpoints, and business rules in Apex. Every change required a deployment.

Read the war story

#19🏗️ ArchitecturePainful

The God Object: One Custom Object to Rule Them All

Created one custom object with 200 fields to handle every use case. It handled none of them well.

Read the war story

#20🏗️ ArchitectureRookie

No Naming Convention: The Org That Named Itself

Let every admin and developer name things however they wanted. Two years later, nobody could find anything.

Read the war story

#21🔒 SecurityCareer-Ending

Forgot 'with sharing': Every User Could See Everything

Wrote an Apex class without the sharing keyword. Every user bypassed all sharing rules. Full org access.

Read the war story

#22🔒 SecurityCareer-Ending

String Concatenation in SOQL: Hello, Injection

Built a dynamic SOQL query with string concatenation from user input. Textbook injection vulnerability.

Read the war story

#23🔒 SecurityPainful

Gave Everyone 'Modify All' Because It Fixed the Bug

Users couldn't edit records. I gave the profile 'Modify All Data' instead of fixing the actual sharing rules.

Read the war story

#24🔒 SecurityPainful

API Keys Hardcoded in Apex: Now in Version Control Forever

Hardcoded an API key in an Apex class. Committed to Git. Deployed to prod. Key visible to every developer.

Read the war story

#25🔒 SecurityAnnoying

New Field Visible to Everyone: Forgot Field-Level Security

Created a Salary__c field on Contact. Checked 'Visible' for all profiles. Every user in the org could see salaries.

Read the war story

#26🔌 IntegrationPainful

Making a Callout from a Trigger

You cannot make HTTP callouts from a synchronous trigger context. Period.

Read the war story

#27🔌 IntegrationCareer-Ending

Hardcoding API Credentials Instead of Using Named Credentials

Hardcoded API keys in Apex are a security audit's worst nightmare.

Read the war story

#28🔌 IntegrationAnnoying

No Retry Logic on External API Calls

External APIs fail. Your integration should expect that.

Read the war story

#29🔌 IntegrationPainful

Publishing Platform Events Without Error Handling

Platform Events can fail to publish. If you don't check, you'll never know.

Read the war story

#30🔌 IntegrationCareer-Ending

Using the Same Connected App Across All Environments

Your sandbox should not talk to production APIs. Ever.

Read the war story

#31🚀 DeploymentPainful

Deploying to Production on Friday Afternoon

Friday deploys turn weekends into war rooms.

Read the war story

#32🚀 DeploymentAnnoying

Deploying Apex Without Including the Test Class

Your deploy will fail at 75% code coverage if you forget the test class.

Read the war story

#33🚀 DeploymentCareer-Ending

Running Destructive Changes Before Deploying Replacements

Delete the old stuff AFTER the new stuff is live. Not before.

Read the war story

#34🚀 DeploymentPainful

Skipping Sandbox and Deploying Straight to Production

If you didn't test it in a sandbox, you're testing it on your users.

Read the war story

#35🚀 DeploymentPainful

Force-Pushing Source That Overwrites Production Customizations

Your local source is not the source of truth. Production is.

Read the war story

#36⚛️ LWCAnnoying

Mixing Wire and Imperative Apex Calls for the Same Data

Pick one: reactive wire or imperative call. Mixing them creates ghost data.

Read the war story

#37⚛️ LWCRookie

Calling querySelector Before the Component Renders

The DOM doesn't exist in connectedCallback. Stop looking for it there.

Read the war story

#38⚛️ LWCPainful

Mutating Objects Without Triggering Reactivity

LWC tracks property assignment, not deep object mutations.

Read the war story

#39⚛️ LWCAnnoying

Custom Events Not Reaching Parent Components

CustomEvent doesn't bubble or compose by default. Your parent never heard you.

Read the war story

#40⚛️ LWCRookie

Using @api Properties Without Default Values in Parent Templates

An unset @api property is undefined, and undefined breaks your template.

Read the war story

#41⚙️ AdminPainful

Validation Rules That Block Your Own Automations

Your validation rule doesn't care if a Flow or trigger made the change.

Read the war story

#42⚙️ AdminCareer-Ending

Creating an Infinite Loop with Record-Triggered Flows

Flow updates record. Update triggers Flow. Flow updates record. Repeat until Salesforce gives up.

Read the war story

#43⚙️ AdminAnnoying

Managing Access with Profiles Instead of Permission Sets

Profiles are for login settings. Permission Sets are for everything else.

Read the war story

#44⚙️ AdminPainful

Workflow Rules, Process Builder, and Flows All Running on the Same Object

Three automation tools on one object means nobody knows what's happening.

Read the war story

#45⚙️ AdminCareer-Ending

Setting OWD to Public Read/Write Because Sharing Was 'Too Complicated'

When everyone can see everything, your data model is a liability.

Read the war story

#46🤖 AI & AgentsPainful

Turning On Einstein Prediction Builder with Dirty Data

AI trained on garbage data gives you garbage predictions with confidence scores.

Read the war story

#47🤖 AI & AgentsCareer-Ending

Deploying Einstein Copilot Without Testing Its Guardrails

An AI assistant with full org access and no guardrails is a data breach waiting to happen.

Read the war story

#48🤖 AI & AgentsAnnoying

Building Prompt Templates Without Grounding in Record Data

An ungrounded prompt hallucinates. A grounded prompt uses your actual Salesforce data.

Read the war story

#49🤖 AI & AgentsCareer-Ending

Letting AI Trigger Actions Without Human-in-the-Loop Approval

AI should suggest. Humans should approve. Not the other way around.

Read the war story

#50🤖 AI & AgentsCareer-Ending

Feeding Customer Data to AI Models Without a Consent Framework

Just because you CAN send customer data to an AI model doesn't mean you SHOULD.

Read the war story

Don't make these mistakes yourself

Hire someone who already made all 50 of them. I'll get it right the first time — because I already got it wrong.

View Consulting

Get Glen's Musings

Occasional thoughts on AI, Claude, investing, and building things. Free. No spam.

Unsubscribe anytime. I respect your inbox more than Congress respects property rights.

50 Salesforce Mistakes I Made So You Don't Have To

The Infinite Flow Loop That Ate Production

Get Records Inside a Loop: The Governor Limit Speedrun

The Flow With No Fault Path (Enjoy Your Cryptic Error)

Hardcoded Record IDs in Flows: The Sandbox Surprise

Using After-Save When Before-Save Would Do

SOQL Query Inside a For Loop (The Classic)

Test Class That Only Tests One Record

Mixed DML: Setup and Non-Setup Objects in the Same Transaction

All Logic in the Trigger Body (No Handler Class)

Flying Blind Without the Limits Class

Mass Update With No Backup: The 'Undo' Button That Doesn't Exist

No Duplicate Rules: 14,000 Duplicate Accounts Later

Hard Delete When Soft Delete Would Do

Data Loader Pointed at Production Instead of Sandbox

10,000 Records Pointing to One Parent: Hello, Lock Errors

5 Process Builders, 3 Flows, 2 Triggers on One Object

Building Custom Objects When Standard Objects Already Exist

Hardcoded Config Values Instead of Custom Metadata Types

The God Object: One Custom Object to Rule Them All

No Naming Convention: The Org That Named Itself

Forgot 'with sharing': Every User Could See Everything

String Concatenation in SOQL: Hello, Injection

Gave Everyone 'Modify All' Because It Fixed the Bug

API Keys Hardcoded in Apex: Now in Version Control Forever

New Field Visible to Everyone: Forgot Field-Level Security

Making a Callout from a Trigger

Hardcoding API Credentials Instead of Using Named Credentials

No Retry Logic on External API Calls

Publishing Platform Events Without Error Handling

Using the Same Connected App Across All Environments

Deploying to Production on Friday Afternoon

Deploying Apex Without Including the Test Class

Running Destructive Changes Before Deploying Replacements

Skipping Sandbox and Deploying Straight to Production

Force-Pushing Source That Overwrites Production Customizations

Mixing Wire and Imperative Apex Calls for the Same Data

Calling querySelector Before the Component Renders

Mutating Objects Without Triggering Reactivity

Custom Events Not Reaching Parent Components

Using @api Properties Without Default Values in Parent Templates

Validation Rules That Block Your Own Automations

Creating an Infinite Loop with Record-Triggered Flows

Managing Access with Profiles Instead of Permission Sets

Workflow Rules, Process Builder, and Flows All Running on the Same Object

Setting OWD to Public Read/Write Because Sharing Was 'Too Complicated'

Turning On Einstein Prediction Builder with Dirty Data

Deploying Einstein Copilot Without Testing Its Guardrails

Building Prompt Templates Without Grounding in Record Data

Letting AI Trigger Actions Without Human-in-the-Loop Approval

Feeding Customer Data to AI Models Without a Consent Framework

Don't make these mistakes yourself

Get Glen's Musings

Keep Exploring

Salesforce Hub

Consulting

Blog