The following versions of python-openevse-http are currently supported with security updates:
| Version | Supported |
|---|---|
| 1.9.x | ✅ |
| < 1.9.0 | ❌ |
The project team takes the security of python-openevse-http seriously. We welcome responsible security reports.
If you believe you have found a security vulnerability, please report it privately through GitHub's Security Advisory system:
- Navigate to the Security Advisories tab of the repository.
- Click Report a vulnerability to open a private advisory draft.
- Include detailed instructions and reproduction steps (see details below).
If you cannot submit a report via GitHub Private Vulnerability Reporting, you may email the maintainer directly at:
- Email: firstof9@gmail.com
- Subject:
[SECURITY] python-openevse-http vulnerability report
To help us investigate and triage issues quickly, please provide as much context as possible:
- Description: A clear summary of the issue and potential security impact.
- Affected versions: Which version(s) of
python-openevse-httpare affected. - Steps to reproduce: Minimal proof-of-concept (PoC) script, HTTP requests/payloads, or reproduction steps.
- Environment: Python version, OS, and any specific OpenEVSE firmware versions or network setups involved.
- Possible mitigations: Any suggested fixes or temporary workarounds, if known.
- Acknowledgment: You should receive an initial response acknowledging your report within 48 hours.
- Triage & Assessment: We will assess the severity and impact, and keep you informed of our progress.
- Resolution & Disclosure: We will collaborate on a fix, release an updated package to PyPI, and coordinate public disclosure / CVE publication through GitHub Security Advisories.