Session State Protection in not Used in any Place

so that Never Protect Page Item when send Value to Item

1. Session state protection is used to prevent the URL Tampering. Whatever the parameter used in
the Calling URL has to set as Session state. So, page level can be applied whenever is required or
item Level

Never Used Authorizations to protect Page

1. Authorization – Implementation will have issue with Modal dialog page calling, Workflow page.
It can be implement.

They are Using Iframe to protect Link from User Hack

1. Iframe – Design wise – requested by PASI (can be disabled the developer tool) and disable the
status link also in the bottom of the browser

hide default Option from Apex and replace It with Custom Code without Handling
Exception
1. Java Script involved in Add Row instead of default add row button – as per requirement

"Embed in Frames" leaves the application vulnerable to clickjacking attacks.

1. As per Requirement – Open the page in “Embed in Frames”. (with same origin)

Validation is not implemented perfectly

1. Item level validation has implemented in all the places. If not yet, please advise to add it
properly. Already we have attribute to set it.