---
description: Secure storage and secret handling
globs: **/*Secret*, **/*Store*, **/secure/**, **/*Credential*, **/*Config*
alwaysApply: false
---

# Secure storage

Full spec: @AGENTS.md §7.5.

- Stores Wi-Fi SSID/password, station list, audio profiles, last-preset index.
  **Encrypted at rest** — `CONFIG_NVS_ENCRYPTION` + flash encryption in
  `sdkconfig.defaults` (development mode); `secure_store::initEncryptedStorage()`
  before any NVS access. See `docs/security-flash-nvs.md`.
- A `Secret` wrapper: no operator<<, no implicit conversion to a loggable
  string, buffer zeroised on destruction.
- Secrets are never logged, never placed in URLs, never serialised to
  plaintext. Access goes through `ISecureStore` so core and tests never
  touch real flash or real keys.