| Value | Sensitivity | Why |
|---|---|---|
local_key (per device) |
Secret | The AES key material for the BLE and LAN sessions. Anyone holding it (within radio/LAN range of the device) can control it. |
local_key (gateway) |
Secret | One key authorizes every sub-device behind the gateway, so treat it as the most sensitive value in the file. |
device_id, uuid, node_id |
Private identifier | Permanently identify your specific unit. Useless for control without a local_key, but there is no reason to publish them — and unlike a key, they can never be rotated. |
product_id |
Public | Shared by every unit of a model (for example, mknd4lci is all Finger Robot 2s), so it identifies the product, not you. |
| Tuya IoT Access ID / Secret | Secret | Cloud API credentials used for the one-time local_key pull (API Explorer or tinytuya wizard). They are never needed at runtime — don't store them in this repo at all. |
All device credentials go in config.toml in the repo root, which is
git-ignored. Start from the committed template:
cp config.example.toml config.tomlRules:
- Never commit
config.toml(or force-add it). - Never paste real values into code, tests, commit messages, issues, or PRs.
Unit tests use synthetic credentials only (
testdevice000000000001,uuidTESTtest0000,abcdef0123456789). - Files produced by credential-pulling tools (such as
tinytuya wizard'sdevices.json,tuya-raw.json,snapshot.json,tinytuya.json) contain secrets — keep them out of the repo and delete them onceconfig.tomlis populated..gitignorecovers the known names.
local_key rotates whenever the device is re-paired in the Smart Life app.
If a key is ever exposed: re-pair the device, then re-pull the new key from
the Tuya IoT console (Cloud → API Explorer → GET /v1.0/devices/{id}).
device_id, uuid, and node_id are burned into the device and cannot be
rotated.
gitleaks scans the full git
history in CI on every push and pull request
(.github/workflows/gitleaks.yml).
Run it locally before pushing:
gitleaks git . --no-banner.gitleaks.toml allowlists the synthetic test credentials
and the YOUR_* placeholders from config.example.toml so real findings
stand out.
If you believe you've found a security issue in the protocol implementations, open a GitHub issue — nothing here touches infrastructure beyond your own LAN and your own devices.