diff --git a/backend/app/models/mail_source.py b/backend/app/models/mail_source.py
index 7bd2517..70e3961 100644
--- a/backend/app/models/mail_source.py
+++ b/backend/app/models/mail_source.py
@@ -39,7 +39,10 @@ class MailSource(Base):
     folder = Column(String, default="INBOX")
 
     # Gmail API OAuth2 credentials (used by GMAIL_API method)
-    # NOTE: tokens stored in plaintext – encrypt at the app layer in production.
+    # NOTE: tokens and secrets are stored in plaintext – in a production
+    # environment these fields should be encrypted at the application layer
+    # (e.g. using Fernet/AES) before persisting, the same way IMAP passwords
+    # should be.  Treat database access as equivalent to credential access.
     gmail_client_id = Column(String, nullable=True)
     gmail_client_secret = Column(Text, nullable=True)
     gmail_access_token = Column(Text, nullable=True)
diff --git a/backend/app/services/gmail_client.py b/backend/app/services/gmail_client.py
index 88282f1..0204195 100644
--- a/backend/app/services/gmail_client.py
+++ b/backend/app/services/gmail_client.py
@@ -11,7 +11,7 @@ import base64
 import email
 import json
 import logging
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 from urllib.parse import urlencode
 
 import httpx
@@ -295,10 +295,7 @@ class GmailClient:
         """
         try:
             msg_data = (
-                service.users()
-                .messages()
-                .get(userId="me", id=msg_id, format="raw")
-                .execute()
+                service.users().messages().get(userId="me", id=msg_id, format="raw").execute()
             )
         except HttpError as exc:
             logger.error("Gmail API: failed to fetch message %s: %s", msg_id, exc)
diff --git a/backend/app/templates/mail_sources.html b/backend/app/templates/mail_sources.html
index b7a1e9d..d691408 100644
--- a/backend/app/templates/mail_sources.html
+++ b/backend/app/templates/mail_sources.html
@@ -463,7 +463,7 @@ function mailSourcesApp() {
                 polling_interval: source.polling_interval || 60,
                 enabled: source.enabled !== false,
                 gmail_client_id: source.gmail_client_id || '',
-                gmail_client_secret: source.gmail_client_secret ? '' : '',  // never pre-fill
+                gmail_client_secret: '',  // never pre-fill client secret
             };
             this.testResult = { message: '', success: false };
             this.showForm = true;