Tech Challenge

A developer stores API credentials in a config file and, to "encrypt" them, wraps each value in Base64. They argue that even if the file leaks, the credentials are safe because they are "encrypted." Why is this reasoning wrong?

import base64

def protect(secret: str) -> str:
    return base64.b64encode(secret.encode()).decode()

stored = protect("db_password=Hunter2!")
# stored -> "ZGJfcGFzc3dvcmQ9SHVudGVyMiE="