crypto review of secret storage

Would like someone with crypto background to review how I currently store secrets

https://github.com/kristovatlas/twoifbysea/blob/master/twoifbysea/crypt.py

Encryption specifications:
    * os.urandom is used for random data. "This function returns random bytes
      from an OS-specific randomness source. The returned data should be
      unpredictable enough for cryptographic applications, though its exact
      quality depends on the OS implementation. On a UNIX-like system this will
      query /dev/urandom, and on Windows it will use CryptGenRandom(). If a
      randomness source is not found, NotImplementedError will be raised."
    * Message is padded with random prefix and suffix to defend known-plaintext
      attacks, probably unnecessarily, given that a random IV is used.
    * A random IV is used for each encryption operation, to be stored along with
      the ciphertext for decryption.
    * AES-256 is used in CBC mode.

Also, application secrets are stored in the server's database as a blake2 hash:

https://github.com/kristovatlas/twoifbysea/blob/603e0b9346e2cd99b3b3ef6f846a223f760064bb/twoifbysea/datastore.py#L416-L468