Marketplace security requirements: is a customer-supplied Git provider PAT stored with kvs.setSecret acceptable for a Forge app?

We store OAuth tokens in external storage and have not had any question or complaint with regard to security requirements. So I would just go ahead, and if Atlassian gives you flack for it you can just point them to this precedence