wind-twin is a local demonstration application. It replays a public SCADA archive and serves it to a local frontend. It is not a control system: nothing it does reaches a turbine, and there is no write path into any industrial system.

The server binds 127.0.0.1:8090 by default and has no authentication, no authorization, and no rate limiting. That is deliberate for a local demo, and it means the following are true and not bugs:

• Anyone who can reach the listening socket can read the full historian and change the replay scenario and speed.
• The historian is a local SQLite file with no encryption at rest.
• CORS is not configured for cross-origin browser use; the frontend is served by Vite in dev and proxies to the same host.

Do not expose this to a network you do not control. If you set TWIN_LISTEN to 0.0.0.0 or put it behind a public hostname, you are responsible for putting authentication in front of it.

One outbound call: the Open-Meteo archive API (free, no key), at startup, cached to data/cache/. Set fetch_weather = false (or TWIN_FETCH_WEATHER=false) to run fully offline — the optional weather field is simply omitted.

No telemetry, analytics, or crash reporting is sent anywhere.

npm audit is not clean, and the remaining entries are known rather than ignored:

• eslint → minimatch → brace-expansion (high, DoS): lint-time only, in a tool that runs on this repo's own files. Clearing it needs ESLint 10.
• vite / esbuild dev server (high/moderate): affects the development server only — npm run dev on localhost. Clearing it needs a Vite major bump.
• echarts < 6.1.0 (moderate, XSS): reachable only through chart labels and tooltips, which are fed numeric telemetry produced by this project. No user-supplied or remote string reaches ECharts. Clearing it needs ECharts 6.

None of these are reachable in the served application by an untrusted party. They are on the list to clear, not below it.

Please report privately rather than opening a public issue: use GitHub's Report a vulnerability button on the Security tab (private vulnerability reporting), or contact the maintainer directly.

In scope and genuinely useful: input handling on the REST query parameters and the WebSocket command channel, the CSV/JSON parsers (they read untrusted files if you point them at one), SQL construction in the historian, and dependency vulnerabilities. Out of scope: the missing authentication described above.

Expect an acknowledgement within a week. This is a personal project maintained in spare time — there is no SLA, and no bounty.