Most of the offered cryptographic primitives (encrypt-data[1], decrypt-data[2], derive-key[3]) are not easy to use correctly.

The encrypt/decrypt data interface uses AES-256-CBC with (seemingly) no authentication, and the key derivation uses PBKDF2 with default iterations of 1000 and vague instructions on which value to choose. No interface to a memory-hard KDF is available.

This, along with the notion of memory safety from untested C code doesn't really instill a sense of confidence in me...

I would suggest throwing away all the cryptographic primitives you currently have and instead interface with libsodium, which is a library designed for the rest of us non-cryptographers.

[1]: https://gliimly.github.io/encrypt-data.html [2]: https://gliimly.github.io/decrypt-data.html [3]: https://gliimly.github.io/derive-key.html