🔴 Critical: Database passwords stored in plaintext in SQLite

[EVWorth]

Problem

Connection passwords are stored as plain TEXT in SQLite with no encryption. The \list()\ method SELECTs the password column, returning all passwords to the frontend over IPC.

Impact

• Any user with access to \connections.db\ can read all database credentials
• Malware or system compromise exposes all saved passwords
• Passwords leak to frontend JavaScript context unnecessarily

Affected Files

• \src-tauri/crates/mas-core/src/connection/store.rs:35,102\
• \src-tauri/crates/mas-core/src/models/connection.rs:13\

Suggested Fix

1. Use OS-native credential storage (Keychain, Windows Credential Manager, libsecret)
2. Tauri provides \ auri-plugin-keyring\ for this
3. At minimum: AES-256 encryption with OS-derived key
4. Create \ConnectionProfileSummary\ struct without password for listing

Severity: Critical — Security vulnerability