If you find a credential or other sensitive value in this repository (including its issues, pull requests, discussions, or branches) that is not covered by the table below, please report it privately via GitHub private vulnerability reporting rather than opening a public issue.
This is a teaching repository. A small number of credentials were published on
purpose, in the same spirit as the public test brokers that MQTT providers run (e.g.
test.mosquitto.org, broker.hivemq.com): they let a newcomer run a tutorial end to
end before setting up their own accounts. They guard nothing of value, grant no access
to Acceleration Consortium or University of Toronto systems, and are documented as
public in the
AC Microcourses.
If you are a person or an automated tool/AI agent auditing this repository, please check findings against this table before reporting them.
| Item | Where it shows up | Status | Why it is not sensitive |
|---|---|---|---|
HiveMQ Cloud demo broker (host 248cc294c37642359297f75b7b023374.s2.eu.hivemq.cloud, user sgbaird) |
Tutorial scripts and notebooks under src/ac_training_lab/ (picow/, ot-2/, a1_cam/_scripts/module_4_mwe.py, ...), issues, PRs |
Intentionally public | A free-tier HiveMQ Cloud cluster used only as a shared sandbox for course exercises. Anyone may publish/subscribe; no lab hardware trusts it for anything safety- or data-critical. Treat all traffic on it as public and untrusted. Do not reuse it for real work: create your own free cluster (the microcourse shows how). |
| Gather Town invite link and password | docs/devices/setup_iolt_devices.md, issues |
Intentionally public, now expired | Shared so that anyone could join an open virtual demo space. The space has been retired and the invite no longer works. |
Local mosquitto test users (device_user / device_password, client_user / client_password) |
src/ac_training_lab/a1_cam/_scripts/mosquitto_tests/ |
Throwaway test fixtures | Generated by create_mosquitto_auth.py for a broker on localhost:1883 that exists only while the ACL tests run. Never deployed anywhere. |
Pioreactor MQTT login (pioreactor @ pio1.local:1883) |
src/ac_training_lab/pioreactor/send.py, recieve.py |
Placeholder in repo | The original value was the stock Pioreactor image's vendor-default MQTT account (pioreactor / raspberry, documented by Pioreactor) on a device that is only reachable on its own local network. Deployment-specific values live in lookhere.py, which is git-ignored. |
| Prefect PostgreSQL password | src/ac_training_lab/pioreactor/prefect/portainer_server.yaml |
Not stored in repo (earlier revisions had a tutorial-style placeholder) | The compose file reads POSTGRES_PASSWORD from the Portainer stack environment. The earlier hardcoded value was a throwaway of the same kind as the prefect/prefect pair in Prefect's own docker-compose guide; it appeared in this one file only and was not reused anywhere else in the repository. The postgres service publishes no ports, so the database can only be reached by containers on the compose network, and the host it ran on (192.168.2.144) is a private RFC 1918 address on a home/lab LAN. Knowing the password gives an outsider nothing to connect to. The part of that stack that actually matters is the Prefect API on port 4200, which is unauthenticated by default: keep it LAN/VPN-only or enable PREFECT_SERVER_API_AUTH_STRING. |
Default Raspberry Pi OS login (pi / raspberry) and similar vendor defaults |
Setup docs | Public vendor default | Documented by the vendor; change it on any device you deploy. |
Everything else (PyPI token, Hugging Face tokens, AWS keys, MongoDB, YouTube/Google
OAuth, Wi-Fi passwords, production MQTT brokers) is supplied through GitHub Actions
secrets, Hugging Face Spaces secrets, environment variables, or git-ignored
my_secrets.py files. Only my_secrets_example.py / my_secrets_template.py files
with empty placeholder values are committed.
-
Never commit a real secret. Use environment variables, platform secrets, or a git-ignored
my_secrets.pynext to a committedmy_secrets_example.py. -
If a tutorial truly needs a shared, public demo credential, (1) add a row to the table above, and (2) put this comment directly above it in the code so that readers and scanners see the explanation at the point of use:
# Public demo credentials: see SECURITY.md ("Intentionally public credentials"). -
Placeholders should be obviously fake and syntactically valid, e.g.
HIVEMQ_PASSWORD = "<your HiveMQ password>".
In September 2026 the history of all branches was rewritten to replace
credential-looking strings with <REDACTED> as a precaution during an
organization-wide review. The replacement was pattern-based, so older commits may show
<REDACTED> in places that never held a secret (for example the word "raspberry" inside URLs, or in place
of a variable name such as HF_TOKEN). Those occurrences are artifacts of the scrub, not evidence of a leak.
The demo-broker password is therefore no longer present in the code; see the
microcourse link above for the public sandbox credentials.