Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/tests/test_email_service.py

@@ -39,4 +39,19 @@ def test_send_test_email_uses_configured_recipient(monkeypatch):
 
     message = smtp.send_message.call_args.args[0]
     assert message['To'] == 'admin@example.com'
-    assert message['Subject'] == 'LinkLog SMTP test'
+    assert message['Subject'] == 'LinkLog SMTP test'
+
+
+def test_smtp_password_is_encrypted_at_rest():
+    from backend.app.services.email_service import get_smtp_settings, save_smtp_settings
+    from backend.app.database import get_connection
+
+    values = {
+        'smtp_host': 'smtp.example.com', 'smtp_port': 587, 'smtp_username': 'mailer',
+        'smtp_password': 'secret', 'smtp_from': 'LinkLog <no-reply@example.com>', 'smtp_use_tls': True,
+    }
+    save_smtp_settings(values)
+    with get_connection() as conn:
+        stored = conn.execute('SELECT value FROM app_settings WHERE name = ?', ('smtp',)).fetchone()['value']
+    assert 'secret' not in stored
+    assert get_smtp_settings()['smtp_password'] == 'secret'