Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

modules/intel/credential_db.py

@@ -17,6 +17,7 @@ import time
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.intel.credential_db")
 
@@ -179,6 +180,8 @@ class CredentialDB(BaseModule):
     def _on_credential_found(self, event) -> None:
         """Handle CREDENTIAL_FOUND events from any capture module."""
         p = event.payload
+        from utils.credential_encryption import decrypt_credential_payload
+        p = decrypt_credential_payload(p)
         self._ingest_credential(
             source_module=event.source_module or p.get("source_module", "unknown"),
             source_ip=p.get("source_ip", ""),