Addressed SA-3 by encrypting the sqlite content with a .env secret

README.md

@@ -167,6 +167,7 @@ The main configurable values are:
 | Variable | Purpose | Default |
 | --- | --- | --- |
 | `LINKLOG_SECRET_KEY` | token signing/security secret | required in Docker |
+| `LINKLOG_DATA_ENCRYPTION_KEY` | Fernet key for encrypting SMTP, Mastodon, and OTP secrets at rest | required in Docker |
 | `LINKLOG_DATABASE_PATH` | SQLite file path inside the container | `/app/backend/data/linklog.db` |
 | `LINKLOG_TOKEN_EXPIRY_DAYS` | access-token lifetime | `30` |
 | `LINKLOG_PUBLIC_URL` | Public hostname used by Traefik and expanded to a callback URL by the backend | `localhost` |
@@ -189,6 +190,8 @@ When a verified user enters the wrong password, LinkLog keeps the response gener
 
 The full set of supported variables is listed in `.env.example`. Application variables are passed into the container by Compose; Docker and Traefik variables are used by Compose itself.
 
+`LINKLOG_DATA_ENCRYPTION_KEY` must be a Fernet key kept outside the database. Generate one with a Python environment that has `cryptography` installed, for example `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`, then store it in `.env` or a protected deployment secret. Losing this key makes encrypted SMTP, Mastodon, and OTP values unrecoverable. Existing plaintext values from earlier versions should be rotated by saving them again after configuring the key.
+
 Build and start the application:
 
 ```sh