I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings.

My situation is:

I have an encryption class. I hardcoded the key for encryption directly in the code. Once I got the comment above, I created a custom setting and then edited the encryption class. All unit tests passed.

When I installed the managed package on a test environment, installing only created a custom setting without any data so the encryption key must be inserted.

I think I'd insert the key using a post install script. But, then I have to hardcode the encryption key in the post install script... Doesn't that mean I'd encounter the hardcoding problem again?

I am very confused. Could anyone please explain how to use custom setting to solve this issue?

1 Answer 1


In response to similar security review feedback, I have a protected custom setting in my managed package (so the setting can't be edited directly in the orgs the managed package is installed in) and a Visualforce page that uses this sort of field:

<apex:inputSecret value="{!c.Secret__c}" redisplay="true"/>

This allows control of who can set the value to be limited to only profiles that include the page and stops anyone from being able to see the value.

  • In my case, the key need to be inserted right after the package is installed. But I don't know how to insert the key to the custom setting but hardcoding the key in post install script which will lead to the insecure credential storage vulnerability again. Is there another way to put the key into the custom setting automatically after installing a managed package?
    – lw29
    Sep 6, 2014 at 7:28
  • 1
    @lw29 You can add an InstallHanlder to your package or always access the key through a class that initialises the key the first time it is referenced. That is assuming that the key can be programmatically generated using e.g. Crypto.generateAesKey. If it has to be manually entered then you will just have to add it to the manual post-install steps.
    – Keith C
    Sep 6, 2014 at 8:40
  • Thank you, Keith C. The key is not programmatically generated so I had to hardcode in the first place. Maybe I need to re-design the system to generate the key each time the package is installed.
    – lw29
    Sep 6, 2014 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .