FAQ-000540 - Custom Settings and Configuration Security / Security Review and Compliance

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
My app uses custom metadata to manage security instead of profiles. How can I explain this custom security model to avoid being flagged for bypassing standard checks?
Answer
To explain your custom security model using custom metadata instead of profiles for the AppExchange Security Review, you can highlight the following: 1. **Use of Protected Custom Metadata**: Explain that your app uses Protected Custom Metadata to securely define and manage security configurations. This ensures sensitive data is not exposed to unauthorized access. 2. **Secure Storage**: Mention that sensitive data, like encryption keys, is stored in protected custom metadata fields and is further secured using encryption mechanisms (e.g., AES symmetric encryption). 3. **Access Control**: Describe how Apex classes are used to manage and access the custom metadata, with access restricted to specific profiles or permission sets to ensure only authorized users or processes can interact with it. 4. **API Integration**: If applicable, explain that any dynamic updates to metadata are handled through secure REST API endpoints, which are restricted and thoroughly vetted to prevent unauthorized access. 5. **Documentation**: Provide clear documentation on how the custom metadata is used for security, including access, updates, and security measures. This approach demonstrates that your custom security model is robust, secure, and compliant with AppExchange Security Review requirements. Let me know if you need help drafting the documentation!
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexBadCryptoAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInVarDeclsAvoidHardcodedCredentialsInVarAssignProtectSensitiveDataApexSuggestUsingNamedCred
Question
My app uses custom metadata to manage security instead of profiles. How can I explain this custom security model to avoid being flagged for bypassing standard checks?
Recommended Answer Update
To explain your custom security model using custom metadata instead of profiles for the AppExchange Security Review, you can highlight the following: 1. **Use of Protected Custom Metadata**: Explain that your app uses Protected Custom Metadata to securely define and manage security configurations. This ensures sensitive data isn't exposed to unauthorized access. 2. **Secure Storage**: Mention that sensitive data, like encryption keys, is stored in protected custom metadata fields and is further secured using encryption mechanisms (e.g., AES symmetric encryption). 3. **Access Control**: Describe how Apex classes are used to manage and access the custom metadata, with access restricted to specific profiles or permission sets to ensure only authorized users or processes can interact with it. 4. **API Integration**: If applicable, explain that any dynamic updates to metadata are handled through secure REST API endpoints, which are restricted and thoroughly vetted to prevent unauthorized access. 5. **Documentation**: Provide clear documentation on how the custom metadata is used for security, including access, updates, and security measures. This approach demonstrates that your custom security model is robust, secure, and compliant with AppExchange Security Review requirements. Let me know if you need help drafting the documentation!
Reasoning
The FAQ is well-structured and provides solid guidance on explaining custom security models to AppExchange reviewers. I made minimal updates to improve conversational tone and clarity: changed "is not exposed" to "isn't exposed" for better conversational flow as per the brand guidelines. The content is accurate and comprehensive. I selected security rules that directly relate to the FAQ's discussion of custom security implementations: ApexBadCrypto relates to the encryption mechanisms mentioned in point 2, credential storage rules (AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInVarDecls, AvoidHardcodedCredentialsInVarAssign) relate to secure storage of sensitive data discussed in points 2 and 5, ProtectSensitiveData applies to the overall approach of protecting sensitive configuration data mentioned throughout, and ApexSuggestUsingNamedCred relates to secure API integration practices mentioned in point 4.
Reasoning References
Recommended Related Articles