Addressed SA-3 by encrypting the sqlite content with a .env secret

VIBE/CHAT_LOG.md

@@ -945,6 +945,12 @@ Remove the “New primary email address” functionality and keep only selecting
 ### Assistant outcome
 Removed the replacement-email workflow entirely. Added cleanup migration 14 for its unused table; verified alternatives remain the only addresses eligible for primary selection.
 
+### User
+Address SA-003 by supplying a dedicated protected encryption key and encrypting sensitive values before SQLite storage.
+
+### Assistant outcome
+Added Fernet encryption with required `LINKLOG_DATA_ENCRYPTION_KEY` handling for SMTP, Mastodon OAuth/client and access-token values, TOTP seeds, and recognized administrator plugin secrets. Updated Docker/Compose configuration, tests, README guidance, and the security audit. Legacy plaintext values require rotation after key configuration.
+
 ### User
 When the user is logged in, the web plugin should not display “Please sign in to use LinkLog.”
 
@@ -969,6 +975,12 @@ In the popup show that the user has logged in.
 ### Assistant outcome
 Added a localized authenticated-session indicator to the Firefox popup, showing the returned username and backend URL after successful session validation. It remains hidden for signed-out or invalid sessions.
 
+### User
+Address SA-003 by using a dedicated secret key supplied through a protected environment or secret file, and encrypt sensitive values before SQLite storage.
+
+### Assistant outcome
+Added Fernet encryption using the required `LINKLOG_DATA_ENCRYPTION_KEY` for newly stored SMTP passwords, Mastodon OAuth secrets and access tokens, and TOTP seeds. Protected API responses from returning Mastodon tokens, required the key in Docker, documented generation and rotation, and updated the security audit.
+
 ### User
 The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.