From 54b6c8f65fde50e0e176dc13a185b6a39f0b92e4 Mon Sep 17 00:00:00 2001
From: Broque Thomas <26755000+Nezreka@users.noreply.github.com>
Date: Fri, 3 Apr 2026 15:25:28 -0700
Subject: [PATCH] Encrypt Last.fm and Discogs credentials at rest

Added lastfm.api_secret, lastfm.session_key, and discogs.token to
_SENSITIVE_PATHS. Auto-encrypted on next startup via migration.
---
 config/settings.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/config/settings.py b/config/settings.py
index 1a6e69d2..ce46db05 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -83,9 +83,12 @@ class ConfigManager:
         'listenbrainz.token',
         'acoustid.api_key',
         'lastfm.api_key',
+        'lastfm.api_secret',
+        'lastfm.session_key',
         'genius.access_token',
         # Other
         'hydrabase.api_key',
+        'discogs.token',
     })
 
     def _get_fernet(self) -> Fernet: