The SQLite database, plaintext backups (c3sMembership.db.backup_*), and invoice PDFs sit unencrypted in the project directory. Encrypt backups (gnupg_encrypt.py already provides key infrastructure for mail — reuse it) and keep DB/backups out of any image or repo; verify .gitignore covers all of them, including invoices/ and webdrivertest.db.
The SQLite database, plaintext backups (
c3sMembership.db.backup_*), and invoice PDFs sit unencrypted in the project directory. Encrypt backups (gnupg_encrypt.pyalready provides key infrastructure for mail — reuse it) and keep DB/backups out of any image or repo; verify.gitignorecovers all of them, includinginvoices/andwebdrivertest.db.