FAQ-000553 - Custom Settings and Configuration Security / Specific Use Cases and Implementation Patterns

No, using a protected custom metadata type with user-editable fields isn't a secure way to store customer-provided secrets. While protected custom metadata types restrict access to sensitive data, user-editable fields can undermine security by allowing unauthorized modifications. For securely storing secrets, use protected custom settings or protected custom metadata with appropriate restrictions, ensuring only privileged users can access or modify the data. For API credentials and external system authentication, Named Credentials provide the most secure approach with built-in encryption and access controls.

The original answer is accurate but can be improved for clarity and completeness. I made these refinements: 1. **Improved conversational tone**: Changed "it is better to use" to "use" for more direct guidance, following the brand guidelines for being direct and conversational. 2. **Added Named Credentials guidance**: Enhanced the existing recommendation by mentioning Named Credentials as the most secure option for API credentials, which aligns with modern Salesforce security best practices. 3. **Maintained all original points**: Preserved the core message about protected custom metadata types, user-editable fields, and alternative approaches. Regarding related security rules: - **ApexSuggestUsingNamedCred**: Directly relates to the FAQ's discussion of "securely storing secrets" - this rule promotes Named Credentials for storing authentication credentials, which is exactly what the FAQ addresses when discussing secure secret storage. - **AvoidHardcodedCredentialsInFieldDecls**: Relates to the FAQ's focus on "customer-provided secrets" storage - this rule prevents hardcoding credentials in field declarations, which connects to the broader topic of secure credential management that the FAQ covers. - **AvoidHardcodedCredentialsInVarDecls**: Connects to the FAQ's discussion of secure secret storage alternatives - this rule prevents hardcoding secrets in variable declarations, supporting the FAQ's guidance away from insecure storage methods. - **AvoidHardcodedCredentialsInVarAssign**: Relates to the FAQ's theme of proper secret management - this rule prevents hardcoded credentials in variable assignments, which aligns with the FAQ's guidance on secure storage practices. - **ProtectSensitiveData**: Directly applies to the FAQ's core topic of "store customer-provided secrets" - this rule focuses on protecting sensitive data, which encompasses the entire scope of what the FAQ discusses regarding secure secret storage in custom metadata types.