cat << 'EOF' | git apply
diff --git a/apps/api/app.py b/apps/api/app.py
--- a/apps/api/app.py
+++ b/apps/api/app.py
@@ -8,6 +8,7 @@
 import secrets
 import shutil
 import uuid
+from cryptography.fernet import Fernet
 from contextlib import suppress
 from datetime import datetime, timedelta
 from pathlib import Path
@@ -58,14 +59,26 @@
 _JWT_SECRET_FILE = Path(os.getenv("FIXOPS_DATA_DIR", ".fixops_data")) / ".jwt_secret"
 
 
+def _get_demo_fernet_key() -> bytes:
+    """
+    For demo mode, generate or fetch a Fernet key (ephemeral, not persisted).
+    In production use, do not use this for encrypting secrets!
+    """
+    key = os.getenv("FIXOPS_DEMO_FERNET_KEY")
+    if not key:
+        key = Fernet.generate_key()
+        logger.warning("Using ephemeral Fernet key for demo JWT secret encryption. "
+                       "All tokens will be invalid after restart unless FIXOPS_DEMO_FERNET_KEY is set.")
+    return key.encode() if isinstance(key, str) else key
+
 def _load_or_generate_jwt_secret() -> str:
     """
     Load JWT secret from environment or file, or generate and persist a new one.
     
     Priority:
     1. FIXOPS_JWT_SECRET environment variable
-    2. Persisted secret file
-    3. Generate new secret and persist to file (demo mode only)
+    2. Persisted secret file (encrypted with Fernet in demo mode)
+    3. Generate new secret and persist to encrypted file (demo mode only)
     
     Returns:
         str: The JWT secret key
@@ -79,31 +86,46 @@
         logger.info("Using JWT secret from FIXOPS_JWT_SECRET environment variable")
         return env_secret
     
-    # Priority 2: Persisted file
+    # Priority 2: Persisted file (in demo mode, file is Fernet-encrypted)
+    mode = os.getenv("FIXOPS_MODE", "").lower()
     try:
         _JWT_SECRET_FILE.parent.mkdir(parents=True, exist_ok=True)
         if _JWT_SECRET_FILE.exists():
-            secret = _JWT_SECRET_FILE.read_text().strip()
-            if secret:
-                logger.info(f"Loaded persisted JWT secret from {_JWT_SECRET_FILE}")
-                return secret
+            if mode == "demo":
+                fkey = _get_demo_fernet_key()
+                fernet = Fernet(fkey)
+                encrypted_secret = _JWT_SECRET_FILE.read_bytes()
+                try:
+                    secret = fernet.decrypt(encrypted_secret).decode()
+                    if secret:
+                        logger.info(f"Loaded Fernet-encrypted JWT secret from {_JWT_SECRET_FILE}")
+                        return secret
+                except Exception as e:
+                    logger.warning(f"Failed to decrypt JWT secret file in demo mode: {e}")
+            else:
+                secret = _JWT_SECRET_FILE.read_text().strip()
+                if secret:
+                    logger.info(f"Loaded persisted JWT secret from {_JWT_SECRET_FILE}")
+                    return secret
     except Exception as e:
         logger.warning(f"Failed to read JWT secret file: {e}")
     
-    # Priority 3: Generate and persist (demo mode only)
-    mode = os.getenv("FIXOPS_MODE", "").lower()
+    # Priority 3: Generate and persist (demo mode only, Fernet-encrypted)
     if mode == "demo":
         secret = secrets.token_hex(32)
+        fkey = _get_demo_fernet_key()
+        fernet = Fernet(fkey)
+        encrypted_secret = fernet.encrypt(secret.encode())
         try:
-            _JWT_SECRET_FILE.write_text(secret)
+            _JWT_SECRET_FILE.write_bytes(encrypted_secret)
             _JWT_SECRET_FILE.chmod(0o600)  # Secure permissions
             logger.warning(
-                f"Generated and persisted new JWT secret to {_JWT_SECRET_FILE}. "
-                "For production, set FIXOPS_JWT_SECRET environment variable."
+                f"Generated and persisted new Fernet-encrypted JWT secret to {_JWT_SECRET_FILE}. "
+                "For production, set FIXOPS_JWT_SECRET environment variable and do NOT use demo mode."
             )
             return secret
         except Exception as e:
-            logger.error(f"Failed to persist JWT secret: {e}")
+            logger.error(f"Failed to persist encrypted JWT secret: {e}")
             logger.warning(
                 "Using non-persisted secret. Tokens will be invalid after restart."
             )
@@ -114,7 +122,6 @@
             "Generate one with: python -c 'import secrets; print(secrets.token_hex(32))'"
         )
 
-
 JWT_SECRET = _load_or_generate_jwt_secret()
 
 
EOF

cat << 'EOF' | git apply
diff --git a/apps/api/requirements.txt b/apps/api/requirements.txt
--- a/apps/api/requirements.txt
+++ b/apps/api/requirements.txt
@@ -1,4 +1,5 @@
 fastapi>=0.110
+cryptography==46.0.3
 uvicorn[standard]>=0.30
 lib4sbom>=0.8.8
 sarif-om>=1.0.4
EOF