Use GitHub's Private Vulnerability Reporting:

• ✅ Confidential until fixed
• ✅ Tracked via Security Advisories
• ✅ CVE assignment if applicable

For non-critical issues:

• Open a GitHub Issue
• Use the Security Issue template if available

• Critical: 24-48 hours
• High: 7 days
• Medium/Low: 14 days

• CodeQL Analysis: Automatic code scanning for Python vulnerabilities
• Dependabot: Weekly dependency security updates
• GitHub Actions Permissions: Least-privilege (contents: read)

• AppArmor Profile: Container isolation with minimal file system access
• Non-root Execution: Runs with reduced privileges
• Network Isolation: No host network access required

• Pre-commit Hooks: Automatic code quality checks (ruff)
• Test Coverage: 86% code coverage with security-focused tests
• Type Checking: MyPy static analysis

⚠️ Modbus TCP is unencrypted:

• Use only on trusted networks (VLAN recommended)
• No authentication mechanism in Modbus protocol
• Consider firewall rules to restrict access

✅ TLS/SSL supported (configure via Home Assistant MQTT)
⚠️ Credentials in plain text (stored in Home Assistant Supervisor)

ℹ️ Slave ID Auto-Detection:

• Tries multiple Slave IDs (0, 1, 2, 100) on startup
• No security risk - only connects to configured inverter IP
• Can be disabled via modbus_auto_detect_slave_id: false

Monitored via Dependabot:

• huawei-solar
• pymodbus
• paho-mqtt

See requirements.txt for full list.

1. VLAN Isolation: Place inverter on separate VLAN
2. Firewall Rules: Restrict Modbus port 502 access
3. MQTT TLS: Enable TLS in Home Assistant MQTT broker

1. Credentials: Use Home Assistant MQTT Service (auto-config)
2. Logging: Avoid TRACE level in production (exposes raw data)
3. Updates: Enable Dependabot alerts

1. Check Logs: Review for unusual connection attempts
2. Status Sensor: Monitor binary_sensor.huawei_solar_status
3. Error Tracking: Watch for repeated authentication failures

• Security vulnerabilities are disclosed after fix is available
• Credit given to researchers who report responsibly
• CVEs assigned for critical vulnerabilities