Please report security issues privately to Bartosz Supcziński at bartek@env.pl. Do not open a public issue before the maintainer has had a reasonable opportunity to investigate and prepare a fix.
Include the affected version, a concise reproduction procedure, the expected impact, and any suggested mitigation. Never include real Wi-Fi, OTA, Home Assistant, or web-interface credentials in a report.
Security model and limitations
The device web interface and /flipper use HTTP Digest authentication, but the transport is plain HTTP. Digest protects the password from being sent as clear text; it does not encrypt page content or signal data. Use the device only on a trusted local network or behind a trusted VPN.
Native ESPHome OTA uses a password generated by the configuration script. Do not commit esphome/secrets.yaml.
Browser-based OTA is authenticated through the device web server. Treat web credentials as local-network secrets and prefer native ESPHome OTA when practical.
The ESPHome native API is intentionally left without an encryption key for compatibility with existing installations. Restrict access to the local IoT network. Contributors may add API encryption in their own deployment, but every affected Home Assistant connection must then be updated.
The fallback access point uses an automatically generated password stored in esphome/secrets.yaml.
Imported and learned signals can operate physical equipment. Verify the target slot and keep people and equipment clear before testing motors, screens, doors, relays, heaters, or similar devices.
Only the latest tagged release is intended to receive security fixes.