Default CLPs for new classes to disallow public read/write

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

The current behaviour when adding a new class via the Parse dashboard is that new classes are created with public read and write permissions in the CLP. This introduces the risk of forgetting to change them which in turn can lead to data leakage and data corruption.

I've searched in the documentation and previous issues, but I have not found a solution or a similar issue discussing this. If there is, please point me in the right direction!

Feature / Enhancement Description

I think the best way would probably be to always default to no permissions at all, and let the developer choose what read and write operations to allow and for what role. Sure, it's an extra step compared to public read/write which allows everything, but it's at the same time much easier to adapt your code in the beginning to use either sessionToken or masterKey where appropriate, rather than changing the permissions a while later and going through your code to find the places where you might have missed it.

If it's not feasible to have as a default, it could be added as a configuration option.

Thanks in advance! 🙏

The issue does not name any files, tests, or entry points. Start by locating how the Parse dashboard creates new classes and assigns default CLPs; define whether no permissions or a configuration option is required, then verify that new classes no longer receive unintended public read/write access.