The card only reads states and the integration's port list in the browser. In scope: anything in this repository that could run code from device names or other data shown on the card, send requests that change something, or leak data to another site.

Please report privately via GitHub's Report a vulnerability, not in a public issue. If you cannot use GitHub, email oss@eize.dev instead.

Only the latest release receives fixes.