Think about the physical security of a studio PC. It is in a room that volunteers, presenters, guests and engineers pass through. It is often logged in. It is rarely locked.
That is the threat model for anything stored on it.
The stream source password
Your Icecast or Shoutcast source password grants write access to your mount point. Anyone holding it can broadcast as you.
It is stored DPAPI-protected rather than in plaintext. Windows Data Protection API ties the encryption to the machine and user account, so copying the config file to another computer yields something that will not decrypt.
AI credentials
The backend auth token is held in encrypted storage rather than as a plain settings value, and access to view or edit AI connection settings is restricted to superusers and admins.
An API key is a billable credential. Leaving one readable in a config file on a shared machine is a direct financial exposure.
The licence
Different problem, different solution. The licence is not secret — it is signed. It carries an RSA signature the application verifies with a public key, while the private key stays with the licence generator and is never shipped.
So the licence file can be read by anyone, and edited by anyone, and neither helps. An edited file no longer matches its signature.
The order viewer, if you run one
Worth mentioning by analogy for anyone running the website side: customer data behind any admin view should require authentication, and the password should be stored as a hash rather than recoverable text.
The same principle applies throughout — store what you need to verify a secret, not the secret itself, wherever the design allows it.
What is not encrypted
Play history, rotation clocks, categories and playlists are stored as ordinary local data. They are not secrets in the same sense, and encrypting them would complicate backup and recovery for no real gain.
The distinction worth holding onto: protect credentials, and make configuration easy to back up.