0012: Secrets in a file only you can read
Status: accepted
Context
Section titled “Context”The share password and Cloudflare tokens must persist for devkitd, which runs in the background as the user.
Decision
Section titled “Decision”Store them in secrets/sharing.json in DevKit’s folder with permissions 0600, never in config.toml, and never return them through the API.
Consequences
Section titled “Consequences”Works the same for the daemon on macOS and Windows without keychain prompts. Anyone who can read your files as you can read them, as with most developer credentials.