FAQ-000497 - Custom Settings and Configuration Security / Protected Custom Settings Security Requirements and Best Practices

Yes, Protected Custom Settings can be used to store credentials entered by the end-user. However, since they don't have a built-in user interface, you'll need to create a custom UI (using Visualforce, Aura, or LWC) to capture the credentials. These credentials can then be securely passed to an Apex class within the managed package for storage. While this approach works, consider using Named Credentials when possible for external system authentication, as they provide additional security features and centralized credential management.

The original answer is technically accurate and well-structured, providing clear guidance on using Protected Custom Settings for storing user-entered credentials. However, it could be enhanced by mentioning Named Credentials as a preferred alternative for external authentication scenarios, which aligns with modern Salesforce security best practices. The selected security rules relate to this FAQ content as follows: 1. **ApexSuggestUsingNamedCred**: This rule suggests using Named Credentials for authentication, which directly relates to the FAQ's discussion of storing credentials. The FAQ discusses credential storage approaches, making this rule highly relevant for providing alternative guidance. 2. **AvoidHardcodedCredentialsInFieldDecls**: While the FAQ doesn't explicitly mention hardcoded credentials in field declarations, it discusses credential storage patterns that developers might implement incorrectly. This rule is relevant as it addresses credential security practices that relate to the credential storage the FAQ discusses. 3. **AvoidHardcodedCredentialsInVarAssign**: Similar to the above, this rule relates to credential handling practices that developers implementing the FAQ's guidance should be aware of to avoid security issues during the credential storage implementation. 4. **AvoidHardcodedCredentialsInVarDecls**: This rule addresses variable-level credential security, which is relevant to the credential handling patterns that would be used when implementing the Protected Custom Settings approach described in the FAQ. 5. **ProtectSensitiveData**: This rule directly applies to the FAQ's core topic of storing credentials (sensitive data). The FAQ discusses storing user credentials, which is exactly the type of sensitive data this rule addresses.