Report vulnerabilities in the panel, node agent, ESP32 connector firmware or Home Assistant integration to: kontakt@coreinfra.eu.
Please include a description, version (panel footer / connector INFO) and steps to reproduce. We acknowledge receipt and let you know our assessment and fix timeline; once the fix is released, we describe it in the changelog. Don't test on other people's sites and don't access other people's data.
Connector firmware updates over OTA: Ed25519-signed image, SHA-256 verified, version numbers only increase. Node agent: signed manifest and update script.
Security support period (updates): until 2030-01-30.