Currently, SubTUI stores server credentials in plaintext in the config directory.

There is specification for an apiKeyAuth method in the OpenSubsonic API which could potentially increase the security by being more easily rotated / disabled in the case of config files being exposed.

I understand the current choice was made since SubTUI's author uses a server which doesn't support this functionality. This issue is meant as a place to discuss the issue and any possible fixes.