Security fixes are applied to the latest revision of the main branch. This
project has not yet declared a stable versioned support window.
Do not open a public issue for a vulnerability, credential exposure, or a flaw that could unexpectedly energize an EVSE.
Use GitHub's Report a vulnerability flow from the repository's Security tab when available. Include:
- affected revision;
- impact and realistic preconditions;
- minimal reproduction steps;
- whether the finding can cause an unintended non-zero current request;
- a suggested mitigation, if known.
Do not include real access tokens, broker passwords, device identifiers, private network details, or unredacted state dumps. Use synthetic values and attach the smallest necessary evidence through the private report.
- Home Assistant installation requires an admin token because it creates helpers, automations, registry state, and a dashboard.
- Runtime MQTT credentials should belong to a dedicated account limited to the required JuiceBox topics.
- The Python controller reads Home Assistant state and writes only the configured JuicePassProxy online-current topic.
- Secrets belong in environment variables or gitignored local files.
- A 0 A software command is not an emergency disconnect or a certified safety interlock.
If credentials are accidentally committed, revoke/rotate them first. Rewriting Git history does not make an already published credential safe again.