Secure Apex/LWC Communication and Safe DOM Manipulation

• Server side (Apex) — AccessLevel.USER_MODE or with sharing (Lesson 2) for CRUD/FLS/sharing enforcement; AuraHandledException (Module 7) to surface safe, deliberate error messages without leaking internal details.
• Client side (LWC) — template bindings that auto-escape by default (Lesson 4), avoiding innerHTML and lwc:dom="manual" on untrusted content.

A component is only as secure as the weaker of these two sides — a perfectly locked-down Apex method still leaks data if the component then dumps the result into innerHTML unsafely, and perfectly safe rendering still leaks data if the Apex behind it skips FLS enforcement.

public with sharing class CaseSummaryController {
    @AuraEnabled(cacheable=true)
    public static List<CaseSummary> getOpenCases(Id accountId) {
        if (accountId == null) {
            throw new AuraHandledException('An Account is required.');
        }

        List<Case> cases = Database.query(
            'SELECT Id, Subject, Status FROM Case WHERE AccountId = :accountId AND IsClosed = false',
            AccessLevel.USER_MODE
        );

        List<CaseSummary> results = new List<CaseSummary>();
        for (Case c : cases) {
            results.add(new CaseSummary(c.Id, c.Subject, c.Status));
        }
        return results;
    }
}

public class CaseSummary {
    @AuraEnabled public Id caseId;
    @AuraEnabled public String subject;
    @AuraEnabled public String status;

    public CaseSummary(Id caseId, String subject, String status) {
        this.caseId = caseId;
        this.subject = subject;
        this.status = status;
    }
}

<template for:each={cases} for:item="caseItem">
    <div key={caseItem.caseId} class="case-row">
        <span>{caseItem.subject}</span> — <span>{caseItem.status}</span>
    </div>
</template>

AccessLevel.USER_MODE (Lesson 2) enforces CRUD/FLS/sharing on the query; AuraHandledException (Module 7) gives a safe, deliberate validation message; the wrapper class (Module 7) shapes the response cleanly; and the template renders every value through ordinary {expression} bindings — no innerHTML, nothing to reintroduce an XSS risk.

1. Does every SOQL query use AccessLevel.USER_MODE or run inside a with sharing class with WITH SECURITY_ENFORCED?
2. Do error messages use AuraHandledException rather than leaking a raw exception's internal details?
3. Is all dynamic content rendered through template bindings, with no innerHTML or lwc:dom="manual" on untrusted data?
4. If a reusable utility class is involved, is its sharing behavior explicit (inherited sharing) rather than ambiguous?