> Historical note from the supplied ZIP. Current findings: `142-REQUIREMENT-AUDIT.md` and `CONSOLIDATED-VERIFICATION.md`.

# Integration credentials and finance update

- AES-256-GCM encryption added for newly saved provider credentials. Set `BABU_INTEGRATION_KEY` as a 64-character random hexadecimal environment variable. Keep it outside source control and backup securely; losing it makes encrypted credentials unreadable.
- Previously stored plaintext credentials remain legacy plaintext until an administrator re-enters them. The UI now flags only encrypted records as configured. Rotate any previously exposed credentials.
- Providers remain disabled; no live provider API integration is claimed.
- Read-only admin finance summary added at `/admin/finance`; order totals filtered by order creation date; payouts and shipment COD totals are all-time. Not a double-entry ledger.
- Smoke test: `php tests/secret_vault_smoke.php`.
- The CodeIgniter framework and live MySQL server are not bundled; end-to-end testing remains outstanding.