Skip to content

Security: AndysWorth/pueo

Security

SECURITY.md

Security Policy

Scope

Pueo holds SSH credentials and writes directly to a live Home Assistant configuration. The attack surface includes:

  • SSH private key handling and known-hosts bypass (known_hosts=None)
  • YAML content generated by a local LLM written to /config/configuration.yaml
  • HA Long-Lived Access Tokens stored in secrets.yaml
  • The backup-before-write safety invariant in the repair pipeline
  • The sandbox check that gates production writes

Vulnerabilities in any of these areas are in scope for responsible disclosure.

Supported versions

Only the latest commit on main receives security fixes. If you are running an older version, upgrade before reporting — the issue may already be fixed.

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Report privately via GitHub's private vulnerability reporting: SecurityReport a vulnerability on this repository.

Include:

  • A description of the vulnerability and its impact
  • Steps to reproduce or a proof-of-concept (responsible disclosure only — no exploit weaponization)
  • The affected layer (ha_agent_core, ha_agent_advanced, ha_agent_sandbox_engine, ha_log_monitor, config.py)
  • Whether the safety invariant (backup-before-write) is bypassed

Response timeline

Step Target
Acknowledgement Within 72 hours
Initial triage Within 7 days
Fix or workaround Within 30 days for critical issues
Public disclosure Coordinated with reporter after fix is merged

Known design decisions with security trade-offs

These are intentional choices documented in the ADRs, not bugs:

Decision Trade-off
known_hosts=None in asyncssh.connect() Accepts any host key — appropriate for a trusted local-network HA host, but vulnerable to MITM on untrusted networks.
LLM-generated YAML written to production config Mitigated by sandbox validation + backup gate, but the LLM output itself is not cryptographically verified.
secrets.yaml mounted read-only in Docker Secrets live on the host filesystem — container escape would expose them.

If you believe any of these trade-offs introduce an unacceptable risk in your deployment, open a regular issue to discuss hardening options.

There aren't any published security advisories