security: Remove debug service exposing coordinator data

[GuyKh]

User description

Summary

Remove the debug service debug_get_coordinator_data which was exposing all coordinator data via a public Home Assistant service.

Security Concern

The debug service was firing events with all coordinator data, which includes:

• Customer information
• JWT tokens
• Billing data
• Meter readings

This is a privacy concern in production environments.

Change

Removed the debug service registration and handler from __init__.py.

---

PR Type

Bug fix

---

Description

• Removes debug service exposing sensitive coordinator data

• Eliminates privacy risk from customer info, JWT tokens, billing data

• Prevents unauthorized access to meter readings via public service

---

Diagram Walkthrough

flowchart LR
  A["Debug Service Handler"] -- "removed" --> B["Service Registration"]
  B -- "eliminates" --> C["Exposed Coordinator Data"]
  C -- "includes" --> D["Sensitive Info:<br/>Tokens, Billing, Meters"]

Loading

File Walkthrough

	Relevant files
Bug fix	__init__.py Remove debug service and coordinator data exposure              custom_components/iec/init.py Removed handle_debug_get_coordinator_data async function Removed service registration call for debug_get_coordinator_data Eliminated event firing that exposed all coordinator data Cleaned up 11 lines of debug service code +0/-11

---

[qodo-code-review]

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

PR Code Suggestions ✨

No code suggestions found for the PR.