I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review.
To achieve this, our logging system creates records for a custom log object. For example, a record might contain the following information:
Message: Invalid API token.
My question is: if these log object records do not contain sensitive data (i.e. Account information, credentials, etc.) does this logging architecture pose any sort of vulnerability that would prevent the application from passing the security review?