Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/services/email_service.py

@@ -7,6 +7,7 @@ import json
 
 from backend.app.core.config import settings
 from backend.app.database import get_connection
+from backend.app.services.secret_store import decrypt_secret, encrypt_secret
 
 
 def get_smtp_settings() -> dict:
@@ -22,6 +23,7 @@ def get_smtp_settings() -> dict:
         row = conn.execute('SELECT value FROM app_settings WHERE name = ?', ('smtp',)).fetchone()
     if row:
         values.update(json.loads(row['value']))
+    values['smtp_password'] = decrypt_secret(values['smtp_password'])
     return values
 
 
@@ -30,7 +32,7 @@ def save_smtp_settings(values: dict) -> None:
         conn.execute(
             '''INSERT INTO app_settings (name, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)
                ON CONFLICT(name) DO UPDATE SET value = excluded.value, updated_at = CURRENT_TIMESTAMP''',
-            ('smtp', json.dumps(values)),
+            ('smtp', json.dumps({**values, 'smtp_password': encrypt_secret(values['smtp_password'])})),
         )
         conn.commit()