A company’s security assessment noted vulnerabilities on the unmanaged packages in its Salesforce orgs; notably, secrets that are easily accessible…

Named Credentials are Salesforce's recommended approach for storing authentication details securely. They encrypt credentials at rest and in transit, while abstracting authentication complexity from code. Protected Custom Metadata Types provide an additional secure storage option with encryption capabilities and controlled access through permissions. Together, they offer the most comprehensive security for secrets, preventing both deliberate and inadvertent exposure while maintaining developer-friendly implementation.

Option B: Encrypted Custom Fields lack the authentication abstraction that Named Credentials provide, requiring manual encryption/decryption in code which increases exposure risk.

Option C: Protected Custom Settings are less secure than Protected Custom Metadata Types as they can be accessed via API and have weaker permission controls.

1. Salesforce Security Guide - "Named Credentials Implementation" - Section 4.2, Pages 89-92

2. Salesforce Developer Documentation - "Custom Metadata Types Security" - Protected Custom Metadata Types section

3. Salesforce Platform Encryption Guide - "Encryption Best Practices" - Chapter 7, Sections 7.3-7.4

4. Salesforce Integration Patterns and Practices - "Secure External Callouts" - Pages 156-159

5. Trailhead: Secure Your Apps with Named Credentials - Module Overview and Implementation sections