I have one app, for this app we need to enter username and passwords and token. The app is working perfectly fine but when uploading in app exchange then security report is not passing it because we are storing username and passwords in custom object.
I have tried below things till now :
- Fields are encrypted field.
- we are using encryption as well.
- I tried with Protected custom setting as well, but after install as managed package , these setting are not visible.
- Named Credential i can't use as this is not satisfying my field value.
What is a secure method of storing this information, which will pass a security review?