Timeline for Manage package security review issue: Insecure Storage of Sensitive Data
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 21 at 21:20 | comment | added | Phil W | The new style can only be managed through the Connect API, but these require expiring metadata such as certificates that need to be managed by the subscriber. No good for automated and packaged connection to end points the managed package does not need to vary by subscriber. | |
| Apr 21 at 20:38 | comment | added | Luke Kozakewycz | Custom metadata is also fine to use. I have a managed package that uses named credentials and not seen any difficulty with it. What is your experience with it? @PhilW | |
| Apr 20 at 18:01 | comment | added | Phil W | You modify it using the built-in metadata API. As documented here. | |
| Apr 20 at 15:01 | comment | added | Mostafa Ghonem | @PhilW I used custom metadata, but I found that it can't be modified from apex(don't support CRUD operations), in my case, I need the users who install the package to use LWC or screen flow to their own Credentials | |
| Apr 19 at 19:02 | comment | added | Phil W | Custom settings are good if you need values specific to a given profile or user, but otherwise custom metadata should be used. Some of the wording from security review can be a bit out-of-date, I have noticed. | |
| Apr 19 at 15:18 | comment | added | Mostafa Ghonem | @PhilW do you mean I should use custom metadata instead? but the security review report recommended using custom settings or Named credentials. and in my case, the named credentials are not ideal. | |
| Apr 19 at 15:05 | comment | added | Phil W | New named credentials are, IMHO, really difficult to use in a managed package. Custom settings have largely been superseded by custom metadata and it is the latter I would consider using. | |
| Apr 19 at 15:01 | comment | added | Mostafa Ghonem | Could I use flow to make users update it? or are allowed using apex only? | |
| S Apr 19 at 14:49 | review | First answers | |||
| Apr 19 at 16:24 | |||||
| S Apr 19 at 14:49 | history | answered | Luke Kozakewycz | CC BY-SA 4.0 |