I have submitted to my app to security review, it resulted me "Password Echo" issue. App consists of a protected custom settings to store the username and password. we have implemented UI to insert/update the user name and password. I have used apex:inputsecret to mask the characters that user inputted. In the inspect element entered value is being displayed. security review is failed resulting the password echo issue.

  • Change they way the input behaves. Have it always load a blank value or fake value. Then use it for entry. That may get around the echo issue as the stores password is never shown. – Eric Aug 24 '18 at 7:04

Generally SF doesn't allow to store username/password in the system. If you do so it will throw an error as you are getting one.

Check if you can remove it and handle it in some other way that's the best you can do here.

If you are unable to remove it or this is a must-have point then create a document where explain the use case why you need this and why you can't remove it and send that document with your listing. It might help you.

SF also has Security team available for this where you can schedule a call with them. Incall you can explain the use case and they might able to provide you some alternative solution or they accept it and will allow it to clear security review.


It sounds like you're doing the right thing. Here is your checklist:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.