Applications not directly embedded in Salesforce must follow these security requirements to ensure data protection and secure integration:
1. **Credential Storage**:
- For server applications, encrypt credentials using AES-128 or higher, and store encryption keys securely (separate from the database layer).
- For client applications, use a secure keychain or keystore provided by the vendor.
2. **Sensitive Data Handling**:
- Avoid writing sensitive data (e.g., social security numbers, API tokens) to debug logs or storing it in unencrypted form.
- Ensure compliance with industry-specific standards.
3. **OAuth and Authorization**:
- Use OAuth for third-party integrations and request only the minimum permissions necessary.
- Do not store Salesforce usernames and passwords.
4. **Remote Site Settings**:
- Use HTTPS for connections to third-party sites, meeting certificate and SSL configuration requirements.
- Avoid arbitrary servers or schemes unless justified by a valid business case.
5. **Security Testing**:
- Conduct thorough security testing, including manual and automated scans, to identify vulnerabilities.
- Test external endpoints involved in data transfer or user authentication.
6. **Debug Logs**:
- Do not include sensitive information (e.g., cryptographic secrets, API credentials, passwords) in debug logs.
- Avoid logging entire requests or responses containing authentication data.
These measures are critical to maintaining the security and integrity of applications interacting with Salesforce.