Finding
From the comprehensive security review in #71 (L2 — Low severity).
File: api_config table in PostgreSQL
The app_config table stores discogs_consumer_key and discogs_consumer_secret as plaintext strings. These are app-level Discogs OAuth credentials.
Impact
A database compromise exposes the Discogs application credentials, which could be used to make OAuth requests impersonating the application. Lower severity than per-user OAuth tokens (addressed in #73 via H2) since these are app-level rather than user-level credentials, but still sensitive.
Proposed Fix
Encrypt discogs_consumer_key and discogs_consumer_secret at rest using the same Fernet symmetric encryption mechanism introduced in #73 for user OAuth tokens (OAUTH_ENCRYPTION_KEY env var / api/auth.py::encrypt_oauth_token / decrypt_oauth_token).
The existing plaintext fallback in decrypt_oauth_token handles migration of already-stored plaintext values without a data migration step.
Notes
Not addressed in #73 — deferred as a separate, lower-priority item.
Finding
From the comprehensive security review in #71 (L2 — Low severity).
File:
api_configtable in PostgreSQLThe
app_configtable storesdiscogs_consumer_keyanddiscogs_consumer_secretas plaintext strings. These are app-level Discogs OAuth credentials.Impact
A database compromise exposes the Discogs application credentials, which could be used to make OAuth requests impersonating the application. Lower severity than per-user OAuth tokens (addressed in #73 via H2) since these are app-level rather than user-level credentials, but still sensitive.
Proposed Fix
Encrypt
discogs_consumer_keyanddiscogs_consumer_secretat rest using the same Fernet symmetric encryption mechanism introduced in #73 for user OAuth tokens (OAUTH_ENCRYPTION_KEYenv var /api/auth.py::encrypt_oauth_token/decrypt_oauth_token).The existing plaintext fallback in
decrypt_oauth_tokenhandles migration of already-stored plaintext values without a data migration step.Notes
Not addressed in #73 — deferred as a separate, lower-priority item.