Report privately, not in a public issue.

Preferred: use GitHub's private vulnerability reporting on this repository, under the Security tab, Report a vulnerability.

Alternative: email michael@floorscape.au with sp-pro-home-assistant in the subject.

Please include:

• What the issue is and where in the code
• How to reproduce it
• What an attacker could achieve
• Your SP PRO model and firmware version, if relevant

Expect an acknowledgement within 7 days. There is no bounty programme.

Only the main branch is supported. There are no tagged releases and no backports. Fixes land on main.

In scope:

• Authentication or authorisation flaws in the bridge HTTP API
• Anything allowing an unauthenticated caller to reach a write endpoint
• Command injection, path traversal or unsafe deserialisation in the bridge
• Credentials or API keys leaking into logs, the web UI, CSV history or error responses
• Anything in this repository that leaks a user's site data

Out of scope:

• Vulnerabilities in Selectronic hardware or firmware. Report those to Selectronic
• Vulnerabilities in Home Assistant itself. Report those to the Home Assistant project
• The design decisions documented below. They are known and deliberate

These are not vulnerabilities. They are documented trade-offs, and they define how this software must be deployed.

Bridge read endpoints are unauthenticated. GET /, /status, /health, /history, /ui and /logs require no credentials. Anyone who can reach port 8765 can read your telemetry. Write endpoints require X-API-Key.

Do not expose port 8765 to the internet. Not behind a port forward, not temporarily. Use a VPN, or Home Assistant's own remote access, and let Home Assistant reach the bridge over the LAN.

The inverter password is stored in plaintext in sp_bridge_config.json and passed to the protocol layer through environment variables. The documented Selectronic default is Selectronic SP PRO.

The API key is stored in plaintext in sp_bridge_config.json. It is generated on first run if left blank. Rotate it with POST /config/rotate-key.

Serial is unauthenticated beyond the inverter password. Physical or network access to the serial path is equivalent to control of generator start and stop.

Generator control writes to the inverter. The bridge rate limits commands to one every 30 seconds and wraps writes in a 10 second timeout, but a caller with the API key can start and stop a generator.

• Put the bridge and the inverter on a management or IoT VLAN, not a flat home network
• Restrict port 8765 to the Home Assistant host if your firewall can do it
• Set a fixed, long API key rather than leaving it blank to regenerate on each start
• Keep the API key in Home Assistant's secrets.yaml, not inline in a package
• Never commit sp_bridge_config.json or secrets.yaml. Both are in .gitignore
• If you do not need generator control, delete the rest_command entries and the generator package. Reading is passive

Bridge and adapter output contains identifying data:

• Inverter serial numbers
• site_name and site_id
• LAN IP addresses and hostnames
• Entity names, which typically map to rooms and buildings

Remove all of it before attaching output to an issue, a forum post or a support ticket.

Monitoring, not protection. Nothing here replaces correctly configured inverter settings, an RCD, or a licensed electrician. Alerting depends on Home Assistant running, your network and a push notification service, so it should not be the only safeguard on a system that matters.