Rotate Tapo camera credentials (bumble_cam/front_porch_camera) -- briefly exposed in a Claude Code session #81

New issue

Open

opened 2026-09-17 16:06:06 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-17 16:06:06 +00:00

Collaborator

Viseron's Tapo camera username/password (shared across both bumble_cam and front_porch_camera, per secrets.yaml on Aegis) were briefly printed in plaintext in a Claude Code session transcript on 2026-09-17, during verification of a new go2rtc stream config (docker exec Viseron curl -s http://localhost:1984/api/streams echoed back the full RTSP producer URLs with embedded basic-auth).

Treat the credentials as compromised. Rotate:

The Tapo camera account/password itself (both cameras use the same login).
secrets.yaml on Aegis (bumble_cam_username, bumble_cam_password, front_porch_camera_username, front_porch_camera_password, plus the two new whole-URL secrets bumble_cam_rtsp_url/front_porch_camera_rtsp_url added the same day for go2rtc).
Restart Viseron after rotating so it picks up the new secrets.

See docs/homelab-architecture.md's Viseron section for the go2rtc/GPU work done in the same session where this happened.

Viseron's Tapo camera username/password (shared across both bumble_cam and front_porch_camera, per `secrets.yaml` on Aegis) were briefly printed in plaintext in a Claude Code session transcript on 2026-09-17, during verification of a new go2rtc stream config (`docker exec Viseron curl -s http://localhost:1984/api/streams` echoed back the full RTSP producer URLs with embedded basic-auth). Treat the credentials as compromised. Rotate: - The Tapo camera account/password itself (both cameras use the same login). - `secrets.yaml` on Aegis (`bumble_cam_username`, `bumble_cam_password`, `front_porch_camera_username`, `front_porch_camera_password`, plus the two new whole-URL secrets `bumble_cam_rtsp_url`/`front_porch_camera_rtsp_url` added the same day for go2rtc). - Restart Viseron after rotating so it picks up the new secrets. See docs/homelab-architecture.md's Viseron section for the go2rtc/GPU work done in the same session where this happened.

claude-bot added the

infra

p:high

labels

2026-09-17 16:06:06 +00:00