iot-protocols

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for literal credentials (API keys, private keys, PSKs, etc.). The only high-entropy, literal value that would function as a secret is the PSKc hex string in the Thread dataset template (assets/thread_dataset_template.env). That value is a 32-hex-character pre-shared key (likely usable as a Thread dataset/master key) and therefore meets the definition of a secret.

I ignored other potential-looking entries because they are clearly placeholders or low-entropy/example values:

• CONFIG_GOLIOTH_DEVICE_PSK="my-pre-shared-key" and CONFIG_GOLIOTH_DEVICE_ID="my-device@my-project" in references/golioth_sdk.md are obvious documentation placeholders / examples, low entropy, and explicitly warned against hardcoding in production.
• network_name=demo-thread-net, pan_id=0x1234, and channel=15 are non-secret configuration/example values. No private key blocks, API keys, or other high-entropy secrets were found beyond the PSKc hex string.