Security fixes are applied to the current main branch. Tagged releases will be listed here when the project begins publishing releases.

Do not open a public issue containing credentials, authentication tokens, inverter serial numbers, plant identifiers, private IP addresses, cloud responses, firmware strings, raw telemetry, or other sensitive evidence.

Use the repository's Security tab and open a private vulnerability report. Include:

• the affected commit or version
• the affected component
• reproduction steps using redacted or synthetic data
• the security impact
• a proposed remediation, when known

The maintainer will acknowledge a complete report, evaluate the impact, and coordinate a correction before public disclosure.

Real LuxPower credentials must remain in:

~/.config/luxpower/.env

The file must have mode 0600. Credentials must never be committed, pasted into issues, included in evidence archives, or embedded in screenshots.

A complete luxpower-readonly-evidence-*.tar.gz archive is private operational evidence even though credentials are excluded. The archive contains a private/ directory that can include plant names, plant IDs, inverter serials, firmware, LAN identities, and live telemetry.

Only deliberately reviewed files from the archive's shareable/ directory may be distributed. The repository must contain synthetic fixtures only.

The project defaults to read-only cloud collection. Local discovery defaults to disabled and requires an explicit interface or private IPv4 CIDR. Any future write or control capability must be separately designed, explicitly enabled by an operator, and documented with safeguards and rollback procedures.