How are maintenance, firmware updates, and security management handled for the device?

Firmware updates are delivered over-the-air (OTA) using HTTPS. AWS Signature Version 4 is used to authenticate inbound requests to AWS. Once configured, the device securely stores WiFi credentials. During initial setup via Bluetooth and the companion app, WiFi credentials are not currently encrypted, meaning a nearby Bluetooth device with physical access could potentially read the SSID and password. However, encrypting this process is on the roadmap for future updates to enhance security during setup.