™Security
Found a security problem in Nucleum Hub, its integration or our servers? Tell us privately, and we fix it first.
Report a vulnerability
- Write to security@nucleumhub.com. Please do not post it publicly, in GitHub or a forum, until we have published a fix.
- Tell us the version, what you found, how to reproduce it, and what an attacker could do with it.
- Machine-readable: /.well-known/security.txt.
What we do
- We confirm your report and keep you informed until it is fixed.
- A vulnerability that is being exploited: our target is a fix within 72 hours.
- We publish an advisory here and in the feed, and credit you if you wish.
- Each long-term (LTS) line gets security fixes for at least 5 years: the dates are on the releases page.
How Nucleum Hub is built
- The dashboard on your screens talks only to your Home Assistant. Its code loads nothing from the internet. A music cover that Home Assistant and the Music Assistant in your home cannot show is converted inside your home by our integration; the one exception is a cover our integration cannot provide either: the screen then fetches it from the music service on the internet, as a last resort, unless you switch this off in Settings.
- Only the integration, on your Home Assistant, talks to our servers, and only to
api.nucleumhub.com. - Every release is published on GitHub, in our public repository, and HACS installs it only when an administrator chooses.
- Locks, gates and the alarm ask before they act, and they stay in Home Assistant’s hands whatever the state of your licence.
Advisories
RSS feed. No advisories so far.