Protect your org data by specifying which objects Experience Cloud guest users and authenticated community or portal users can query through Omnistudio. Omnistudio now blocks SOQL queries and SOSL searches that external users run through the HandleData() and HandleDataCards() methods unless every object in the query is on an allowlist that you maintain. Allowed queries run in user mode, so the user's object permissions, field-level security, and sharing rules apply.
Where: This change applies to Experience Cloud Aura sites accessed through Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions with Omnistudio for Managed Packages.
Who: This change affects Experience Cloud guest users and authenticated community, portal, partner, and customer users who use components that load data through SOQL or SOSL queries, such as Flexcards, Vlocity Cards, custom Lightning components, and Industries cloud features. Internal users aren't affected. Data Mappers, Integration Procedures, Apex Remote actions, and REST data sources aren't affected.
Why: The allowlist is enforced by default and starts empty. Until you add the objects that your site components query, external users can't query any object through these methods, and affected components show no records. A fixed set of security and code objects, such as Apex classes and profiles, is always blocked and can't be added to the allowlist.