Only the latest release receives security fixes.

Please report vulnerabilities privately via GitHub's private vulnerability reporting — do not open a public issue for security problems.

You can expect an initial response within a week. Please include steps to reproduce and the affected version.

• This integration authenticates against the CheckWatt / EnergyInBalance cloud API with the user's email and password. Home Assistant stores config entry credentials unencrypted in its .storage directory — protect access to your HA instance and its backups accordingly. This is standard for HA integrations; the API offers no OAuth or API-key alternative.
• The API used is unofficial (reverse-engineered) and operated by CheckWatt AB. Vulnerabilities in the API itself should be reported to CheckWatt, not here.
• News items are fetched from a public, unauthenticated endpoint; no credentials or tokens are ever sent to it.