I am in the thick of creating a salesforce application. I just got my security review back and was rejected because of "Insecure Storage of Sensitive Data". I've read the description of the issue as well as the link that they provided on secure coding, but i'm still not sure I understand it fully. I am getting login information for my companies website from the user inside of salesforce. I'm then storing that information in a variable to later use it to send the user name and password of the users account to my companies API. I understand that I need to change that, I'm just not totally sure how to implement the changes. What I don't quite understand is how I am supposed to get the login information from my users, store it securely, and then send it to our API. So I understand that is it more secure to encrypt sensitive information, but will I be able to decrypt the information to send it to our API?
The documentation the security team sent you seems to have all you need and it points you in the direction you need to head:
External applications should not store Salesforce.com user credentials (usernames, passwords, or session ID's) in external databases. In order to integrate an external application with Salesforce.com user accounts, the OAuth flow should be used. More information about implementing OAuth can be found at here.
If you dont quite understand how to implement this in your app, there are plenty of examples out there as well as saleforce developer blogs.
Give it a shot, and if you dont understand or face any particular issues, feel free to open posts here, or if not within the scope of the help center, there is stackoverflow for more general programming questions (oauth related for example)