I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an external API, for which it has its own API Secret and API Key. These are static, and specific to the Salesforce App- they will be the same for all users, all installations, etc.
Perhaps stupidly, I stored them as private properties of the class that uses them.
private static String apiSecret = 'superS3|<R37';
private static String apiKey = 'sameHerebutdifferent';
It is a Managed app, so users cannot see them. As such, I am puzzled as to 1. why this is insecure and 2. how better to store these values, given that we are apparently operating under the assumption that having them in the text of the class itself is insecure.