Please report security issues privately through GitHub Security Advisories rather than opening a public issue. Include what you observed, how to reproduce it, and what an attacker could reach.
This is a personal fork maintained in spare time — expect a first response within about a week. Issues in the upstream project belong at jjarboe01/TECO-HA-AddOn.
It logs into your utility account and keeps a local archive of your bills. Worth knowing what that means:
- Your TECO username and password are stored by the Home Assistant Supervisor
in
/data/options.jsonand passed to the process as environment variables. They are never logged and never written to the bill cache. - Your billing archive — service periods, usage, cost, meter reads, contract
account numbers — lives in
/data/cache/inside the add-on container and is included in Home Assistant backups. Treat those backups as sensitive. - A headless Chromium browses
account.tecoenergy.comas you. It runs with--no-sandboxbecause add-on containers run as root, where Chromium refuses to start otherwise; it is confined by the container and only ever navigates TECO.
- The dashboard is served over Home Assistant ingress, which HA authenticates. Nothing extra is needed for normal use.
- The API port is not published by default. If you publish
8089in the add-on's Network tab,/data,/exportand/billsbecome reachable from your LAN — setauth_tokenwhen you do. The add-on logs a warning at startup if no token is set. - Requests skip the token only when they genuinely arrive from the Supervisor
network (
172.30.32.0/23). TheX-Ingress-Pathheader alone is not accepted as proof of ingress — headers are attacker-controlled. Seetests/test_auth.py, which is run by CI to keep that from regressing.
| Ingress exemption | Bound to the Supervisor source address, not a header |
| Token comparison | secrets.compare_digest (constant time) |
| API port | Unpublished by default; opt-in per install |
| Interactive API docs | Disabled (/docs, /redoc, /openapi.json) |
| CI actions | Pinned to commit SHAs, not movable tags |
| Workflow token | permissions: contents: read |
| Dependencies | Bounded ranges, tracked by Dependabot |
| Secrets in git | Credentials, fixtures, caches and dumps are gitignored |
- Sensor states are pushed to Home Assistant over the Supervisor API using the
token the Supervisor injects. Any add-on with
homeassistant_api: truehas comparable access. - The bill cache is not encrypted at rest. It is protected by the same boundary as the rest of your Home Assistant data.