0

My application is currently undergoing security review and has been reported with the 'Insecure Storage of Sensitive Data' issue, cause I'm storing the auth credentials in custom Object to enable users who install the package to update it with their credentials.

recommended solution: to use a protected custom setting, but the protected custom setting can't be changed in manage packages.

How should I store these credentials to solve the Insecure Storage of Sensitive Data' issue and can be edited by the users?

Improve this question

1 Answer 1

Reset to default
1

Protected custom settings are in fact accessible and updateable, but you need to write your own code to do so and must be within the same managed package.

It is ideal to use protected custom settings for sensitive data. But if you are storing credentials, perhaps consider Named Credentials if you can.

https://help.salesforce.com/s/articleView?id=sf.cs_schema_settings.htm&type=5

Improve this answer
8
  • Could I use flow to make users update it? or are allowed using apex only?
    – Mostafa Ghonem
    Commented Apr 19 at 15:01
  • New named credentials are, IMHO, really difficult to use in a managed package. Custom settings have largely been superseded by custom metadata and it is the latter I would consider using.
    – Phil W
    Commented Apr 19 at 15:05
  • @PhilW do you mean I should use custom metadata instead? but the security review report recommended using custom settings or Named credentials. and in my case, the named credentials are not ideal.
    – Mostafa Ghonem
    Commented Apr 19 at 15:18
  • Custom settings are good if you need values specific to a given profile or user, but otherwise custom metadata should be used. Some of the wording from security review can be a bit out-of-date, I have noticed.
    – Phil W
    Commented Apr 19 at 19:02
  • @PhilW I used custom metadata, but I found that it can't be modified from apex(don't support CRUD operations), in my case, I need the users who install the package to use LWC or screen flow to their own Credentials
    – Mostafa Ghonem
    Commented Apr 20 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .