Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/services/plugin_manager.py

@@ -8,6 +8,7 @@ from urllib.parse import urlencode
 from urllib.request import Request, urlopen
 
 from backend.app.plugins.base import BasePlugin
+from backend.app.services.secret_store import decrypt_secret
 
 DEFAULT_POST_PREFIX = 'From my #LinkLog: '
 logger = logging.getLogger(__name__)
@@ -47,6 +48,7 @@ class MastodonPlugin(BasePlugin):
                 ).fetchone()
             if row and row['config']:
                 config.update(json.loads(row['config']))
+        config['access_token'] = decrypt_secret(config.get('access_token', ''))
 
         instance = str(config.get('instance', '')).strip().rstrip('/')
         if instance and '://' not in instance:
@@ -135,6 +137,7 @@ class MastodonPlugin(BasePlugin):
                 ).fetchone()
             if row and row['config']:
                 config.update(json.loads(row['config']))
+        config['access_token'] = decrypt_secret(config.get('access_token', ''))
 
         instance = str(config.get('instance', '')).strip().rstrip('/')
         if instance and '://' not in instance: