I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings.
My situation is:
I have an encryption class. I hardcoded the key for encryption directly in the code. Once I got the comment above, I created a custom setting and then edited the encryption class. All unit tests passed.
When I installed the managed package on a test environment, installing only created a custom setting without any data so the encryption key must be inserted.
I think I'd insert the key using a post install script. But, then I have to hardcode the encryption key in the post install script... Doesn't that mean I'd encounter the hardcoding problem again?
I am very confused. Could anyone please explain how to use custom setting to solve this issue?