Is it secure to store sensitive data in custom metadata types that subscribers can manipulate?
Answer
Storing sensitive data in custom metadata types that subscribers can manipulate is not secure. It is recommended to use protected custom settings or protected custom metadata to ensure that sensitive data is not exposed or modifiable by subscribers. This approach provides a secure way to store and manage sensitive information while limiting access to authorized users only.
Is it secure to store sensitive data in custom metadata types that subscribers can manipulate?
Recommended Answer Update
Storing sensitive data in custom metadata types that subscribers can manipulate isn't secure. Use protected custom settings or protected custom metadata instead to ensure sensitive data isn't exposed or modifiable by subscribers. This approach provides a secure way to store and manage sensitive information while limiting access to authorized users only.
Reasoning
Made minor improvements to make the answer more conversational and direct by using contractions ('isn't' instead of 'is not') and slightly more natural phrasing, while preserving all the original content and technical guidance. The ProtectSensitiveData rule is directly related to this FAQ because the FAQ discusses storing sensitive data securely and preventing unauthorized access to sensitive information. The FAQ's core message about not storing sensitive data in subscriber-manipulable custom metadata types and recommending protected alternatives aligns with the ProtectSensitiveData rule's purpose of ensuring sensitive data is properly protected from unauthorized access.