I have created a managed package where I used a protected Custom Setting of hierarchy type to store some user credentials.

I am concerned about security review of the app. Is there any chances of getting security review failed when sales force do the review?

I used apex to manage this custom setting data.

  • 3
    Incidentally, I recently went through a security review in which they themselves actually advised to store credentials in protected custom settings, so you should be good. – rael_kid Sep 18 '20 at 19:41
  • Thanks for the update – Sushant Srivastava Sep 19 '20 at 0:44

From the past experience, user credentials like password need to be stored either in a protected custom setting or custom metadata for a Managed Package Application.

With protected custom setting subscriber orgs have no way to see them. Only your Managed package apex code can see the data and hence it is safe.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.