Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/api/admin.py

@@ -20,6 +20,7 @@ from backend.app.services.email_service import (
 )
 from backend.app.services.email_verification import create_verification_token
 from backend.app.services.theme_service import THEMES, get_enabled_themes, save_enabled_themes
+from backend.app.services.secret_store import encrypt_secret
 from backend.app.core.config import settings
 
 router = APIRouter()
@@ -345,6 +346,9 @@ def update_plugin(
         config = json.loads(current['config']) if current['config'] else {}
         if payload.config is not None:
             config.update(payload.config)
+        for secret_name in ('access_token', 'client_secret', 'smtp_password'):
+            if config.get(secret_name):
+                config[secret_name] = encrypt_secret(config[secret_name])
 
         conn.execute(
             '''