Your secrets are out there in public to connect with your Tado.

[marcofranssen]

You have committed the client-id and client-secret. Should I turn on the Heat ;-).

FYI: just remove you current secret from Tado so no one can abuse and create a new one, but don't commit it.

[SebastiaanKlippert]

Always appreciated for pointing this out, but authentication is done with a username and password which is not committed as far as I can see.

If you are referring to the wZaRN7rpjn3FoNyF5I client secret, that is the client secret for the TADO web app, this is available on the web and can be found in the TADO web app.
I could have added a comment there in my code, but this was just an experiment.