I am designing an account system that will use salting/hashing to securely store and compare passwords. For now, I'm looking at using bcrypt for password hashing. Somewhere along the way I'll need a way to ensure that users can store secrets in their account. These secrets will need to be encrypted using a key derived from the user's login info and decrypted the same way. I want to make it such that even if someone has access to the whole database contents and source code for the front- and back-ends, they cannot access the data in these secrets. How can I do this?
If it's helpful, the web app is being developed with a Python/Flask backend.
Edit: These secrets aren't nuclear codes or anything like that. They're keys to unlock private messages and non-public chat rooms. I do not trust clients. I never trust web browsers...