Storing the secret

[bemurphy]

This is more about TOTP in general but thought it was worth asking here.

Are there recommendations on securely storing the TOTP.secret per user in the database?

I'm uneasy with cleartext because if somebody can grab read-only access to that table or a backup, they have the secrets.

The best thought I've had so far is using symmetric encryption with the key in the ENV. Is there a better way?