I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as well as the link that they provided on secure coding, but i'm still not sure I understand it fully. I am getting login information for my companies website from the user inside of salesforce. I'm then storing that information in a variable to later use it to send the user name and password of the users account to my companies API. I understand that I need to change that, I'm just not totally sure how to implement the changes. What I don't quite understand is how I am supposed to get the login information from my users, store it securely, and then send it to our API. So I understand that is it more secure to encrypt sensitive information, but will I be able to decrypt the information to send it to our API?

Secure coding link

  • would you mind sharing "the link that they provided on secure coding" it might help narrow down any answer (if any). if you dont understand something from the link provided, you might want to update the post stating so as well and highlight what part you dont understand.
    – glls
    Nov 21, 2017 at 21:40
  • Thanks for the suggestions. I tried my best to better explain what I don't understand. Nov 21, 2017 at 21:56
  • the answer seems to be right there: "OAuth flow should be used. " and there is a link to the documentation as well
    – glls
    Nov 21, 2017 at 23:19

1 Answer 1


The documentation the security team sent you seems to have all you need and it points you in the direction you need to head:

Salesforce.com Integrations

External applications should not store Salesforce.com user credentials (usernames, passwords, or session ID's) in external databases. In order to integrate an external application with Salesforce.com user accounts, the OAuth flow should be used. More information about implementing OAuth can be found at here.

If you dont quite understand how to implement this in your app, there are plenty of examples out there as well as saleforce developer blogs.

Give it a shot, and if you dont understand or face any particular issues, feel free to open posts here, or if not within the scope of the help center, there is stackoverflow for more general programming questions (oauth related for example)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .