goruck/home-generative-agent

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.devcontainer/docker-compose.yaml line 17
Likely real: Yes, 100% confidence

Service 'pgvector_db' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

pgvector_db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.devcontainer/docker-compose.yaml line 3
Likely real: Yes, 100% confidence

Service 'devcontainer' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to prevent this.

devcontainer:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/agent/token_counter.py line 351
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "Token count for %s (approx fallback): %d" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

LOGGER.debug("Token count for %s (approx fallback): %d", key, approx)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/agent/graph.py line 2779
Likely real: Yes, 100% confidence

Detected a python logger call with a potential hardcoded secret "Token counts from metadata: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

LOGGER.debug("Token counts from metadata: %s", metadata)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.devcontainer/docker-compose.yaml line 17
Likely real: Yes, 99% confidence

Service 'pgvector_db' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

pgvector_db:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.devcontainer/docker-compose.yaml line 3
Likely real: Yes, 99% confidence

Service 'devcontainer' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

devcontainer:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/dependabot.yml line 4
Likely real: Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

- package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/dependabot.yml line 9
Likely real: Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

- package-ecosystem: "pip"
    directory: "/requirements"
    schedule:
      interval: "weekly"
    ignore:
      # Dependabot should not update Home Assistant as that should match the homeassistant key in hacs.json
      - dependency-name: "homeassistant"
      # openai must match HA core's openai_conversation pin for the tested HA version
      # (and langchain-openai in manifest.json caps it), so it is bumped by hand.
      - dependency-name: "openai"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/agent/token_counter.py line 65
Likely real: Yes, 99% confidence

Detected a python logger call with a potential hardcoded secret "Exact token counting for %s failed; using approximate counts for the " "next %.0f seconds. Conversation continues. Cause: %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.

LOGGER.warning(
            "Exact token counting for %s failed; using approximate counts for the "
            "next %.0f seconds. Conversation continues. Cause: %s",
            key,
            REMOTE_COUNT_COOLDOWN_S,
            _redact_secrets(str(exc)),
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/claude.yml line 29
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/claude-code-review.yml line 43
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: anthropics/claude-code-action@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/claude-code-review.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/claude.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: anthropics/claude-code-action@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint.yml line 17
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "actions/checkout@v7"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7.0.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release.yml line 18
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "actions/checkout@v7"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release.yml line 27
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "softprops/action-gh-release@v3.0.3"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 21
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "actions/checkout@v7"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 24
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7.0.0

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/validate.yml line 20
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "actions/checkout@v7"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/validate.yml line 23
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "home-assistant/actions/hassfest@master"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/validate.yml line 30
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "actions/checkout@v7"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/validate.yml line 33
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: "hacs/action@main"

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/agent/helpers.py line 93
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = importlib.import_module(module_name)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/auth_inventory.py line 66
Likely real: Yes, 95% confidence

Possible hardcoded password: 'system'

65 TOKEN_TYPE_NORMAL = "normal"  # noqa: S105
66 TOKEN_TYPE_SYSTEM = "system"  # noqa: S105
67 TOKEN_TYPE_LONG_LIVED = "long_lived_access_token"  # noqa: S105

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/auth_inventory.py line 65
Likely real: Yes, 95% confidence

Possible hardcoded password: 'normal'

64 # internals into the pure-data layer.
65 TOKEN_TYPE_NORMAL = "normal"  # noqa: S105
66 TOKEN_TYPE_SYSTEM = "system"  # noqa: S105

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/const.py line 100
Likely real: Yes, 95% confidence

Possible hardcoded password: 'ha_password'

99 RECOMMENDED_DB_USERNAME = "ha_user"
100 RECOMMENDED_DB_PASSWORD = "ha_password"  # noqa: S105
101 RECOMMENDED_DB_HOST = "localhost"

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier.py line 795
Likely real: Yes, 95% confidence

Possible hardcoded password: 'type_ha_long_lived_token_stale'

794     "ha_new_admin_or_token": "type_ha_new_admin_or_token",
795     "ha_long_lived_token_stale": "type_ha_long_lived_token_stale",
796     "ha_failed_logins": "type_ha_failed_logins",
797     "ha_cloud_remote_ui_enabled": "type_ha_cloud_remote_ui_enabled",
798     "ha_addon_exposed_port": "type_ha_addon_exposed_port",
799     "ha_addon_unprotected": "type_ha_addon_unprotected",
800     "ha_webhook_automation_public": "type_ha_webhook_automation_public",
801     "ha_trusted_networks_bypass_login": "type_ha_trusted_networks_bypass_login",
802     "ha_http_proxy_misconfigured": "type_ha_http_proxy_misconfigured",
803     "security_device_unavailable": "type_security_device_unavailable",
804     "network_unconfigured_discovered_device": (
805         "type_network_unconfigured_discovered_device"
806     ),
807     "network_router_update_pending": "type_network_router_update_pending",
808     "network_upnp_enabled": "type_network_upnp_enabled",
809     "network_public_ip_changed": "type_network_public_ip_changed",
810     "network_upnp_port_mapping_added": "type_network_upnp_port_mapping_added",
811     "radio_new_device_joined": "type_radio_new_device_joined",
812     "network_unknown_device_joined": "type_network_unknown_device_joined",
813     "network_guest_client_present": "type_network_guest_client_present",
814     "network_guest_network_idle": "type_network_guest_network_idle",
815     "network_wpa3_disabled": "type_network_wpa3_disabled",
816     "network_protection_disabled": "type_network_protection_disabled",
817     "network_ddns_enabled": "type_network_ddns_enabled",
818     "zwave_insecure_security_class": "type_zwave_insecure_security_class",
819     "zigbee_permit_join_open": "type_zigbee_permit_join_open",
820     "zwave_inclusion_active": "type_zwave_inclusion_active",
821     "radio_coordinator_update_pending": "type_radio_coordinator_update_pending",
822     "appliance_power_duration": "type_appliance_power_duration",
823 }
824 
825 
826 def _display_type(finding: AnomalyFinding, hass: HomeAssistant | None = None) -> str:
827     """
828     Friendly label for a finding.
829 
830     Dynamic rules carry slugified candidate IDs as ``finding.type``; when the
831     type has no curated label but the rule's template does, prefer the
832     template label so notifications never show raw candidate slugs
833     (issue #516 review).
834     """
835     if finding.type in _KNOWN_TYPE_LABEL_KEYS:
836         return notif_msg(hass, _KNOWN_TYPE_LABEL_KEYS[finding.type])
837     template_id = str(finding.evidence.get("template_id") or "")
838     if template_id in _KNOWN_TYPE_LABEL_KEYS:
839         return notif_msg(hass, _KNOWN_TYPE_LABEL_KEYS[template_id])
840     return _friendly_type(finding.type, hass)
841 
842 
843 def _friendly_type(anomaly_type: str, hass: HomeAssistant | None = None) -> str:
844     if anomaly_type in _KNOWN_TYPE_LABEL_KEYS:
845         return notif_msg(hass, _KNOWN_TYPE_LABEL_KEYS[anomaly_type])

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier.py line 794
Likely real: Yes, 95% confidence

Possible hardcoded password: 'type_ha_new_admin_or_token'

793     ),
794     "ha_new_admin_or_token": "type_ha_new_admin_or_token",
795     "ha_long_lived_token_stale": "type_ha_long_lived_token_stale",
796     "ha_failed_logins": "type_ha_failed_logins",
797     "ha_cloud_remote_ui_enabled": "type_ha_cloud_remote_ui_enabled",
798     "ha_addon_exposed_port": "type_ha_addon_exposed_port",
799     "ha_addon_unprotected": "type_ha_addon_unprotected",
800     "ha_webhook_automation_public": "type_ha_webhook_automation_public",
801     "ha_trusted_networks_bypass_login": "type_ha_trusted_networks_bypass_login",
802     "ha_http_proxy_misconfigured": "type_ha_http_proxy_misconfigured",
803     "security_device_unavailable": "type_security_device_unavailable",
804     "network_unconfigured_discovered_device": (
805         "type_network_unconfigured_discovered_device"
806     ),
807     "network_router_update_pending": "type_network_router_update_pending",
808     "network_upnp_enabled": "type_network_upnp_enabled",
809     "network_public_ip_changed": "type_network_public_ip_changed",
810     "network_upnp_port_mapping_added": "type_network_upnp_port_mapping_added",
811     "radio_new_device_joined": "type_radio_new_device_joined",
812     "network_unknown_device_joined": "type_network_unknown_device_joined",
813     "network_guest_client_present": "type_network_guest_client_present",
814     "network_guest_network_idle": "type_network_guest_network_idle",
815     "network_wpa3_disabled": "type_network_wpa3_disabled",
816     "network_protection_disabled": "type_network_protection_disabled",
817     "network_ddns_enabled": "type_network_ddns_enabled",
818     "zwave_insecure_security_class": "type_zwave_insecure_security_class",
819     "zigbee_permit_join_open": "type_zigbee_permit_join_open",
820     "zwave_inclusion_active": "type_zwave_inclusion_active",
821     "radio_coordinator_update_pending": "type_radio_coordinator_update_pending",
822     "appliance_power_duration": "type_appliance_power_duration",
823 }
824 
825 
826 def _display_type(finding: AnomalyFinding, hass: HomeAssistant | None = None) -> str:
827     """
828     Friendly label for a finding.
829 
830     Dynamic rules carry slugified candidate IDs as ``finding.type``; when the
831     type has no curated label but the rule's template does, prefer the
832     template label so notifications never show raw candidate slugs
833     (issue #516 review).
834     """
835     if finding.type in _KNOWN_TYPE_LABEL_KEYS:
836         return notif_msg(hass, _KNOWN_TYPE_LABEL_KEYS[finding.type])
837     template_id = str(finding.evidence.get("template_id") or "")
838     if template_id in _KNOWN_TYPE_LABEL_KEYS:
839         return notif_msg(hass, _KNOWN_TYPE_LABEL_KEYS[template_id])
840     return _friendly_type(finding.type, hass)
841 
842 
843 def _friendly_type(anomaly_type: str, hass: HomeAssistant | None = None) -> str:
844     if anomaly_type in _KNOWN_TYPE_LABEL_KEYS:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/auth_inventory.py line 67
Likely real: Yes, 95% confidence

Possible hardcoded password: 'long_lived_access_token'

66 TOKEN_TYPE_SYSTEM = "system"  # noqa: S105
67 TOKEN_TYPE_LONG_LIVED = "long_lived_access_token"  # noqa: S105
68

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/const.py line 390
Likely real: Yes, 95% confidence

Possible hardcoded password: 'sentinel_ha_token_stale_days'

389 # Days a long-lived access token may go unused before it is reported stale.
390 CONF_SENTINEL_HA_TOKEN_STALE_DAYS = "sentinel_ha_token_stale_days"  # noqa: S105
391 RECOMMENDED_SENTINEL_HA_TOKEN_STALE_DAYS: int = 90

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier_messages.py line 143
Likely real: Yes, 91% confidence

Possible hardcoded password: 'Starý dlouhodobý přístupový token'

142         "type_ha_new_admin_or_token": "Nový administrátor nebo přístupový token",
143         "type_ha_long_lived_token_stale": "Starý dlouhodobý přístupový token",
144         "type_ha_failed_logins": "Neúspěšné pokusy o přihlášení",
145         "type_ha_cloud_remote_ui_enabled": "Vzdálený přístup přes cloud je zapnutý",
146         "type_ha_addon_exposed_port": "Port doplňku vystaven na hostiteli",
147         "type_ha_addon_unprotected": "Ochranný režim doplňku vypnutý",
148         "type_ha_webhook_automation_public": "Veřejná webhook automatizace",
149         "type_ha_trusted_networks_bypass_login": (
150             "Obejití přihlášení z důvěryhodné sítě"
151         ),
152         "type_ha_http_proxy_misconfigured": "Blokování IP adres vypnuté",
153         "type_security_device_unavailable": "Bezpečnostní zařízení nedostupné",
154         "type_network_unconfigured_discovered_device": (
155             "Nalezeno nenakonfigurované zařízení"
156         ),
157         "type_network_router_update_pending": "K dispozici aktualizace routeru",
158         "type_network_upnp_enabled": "UPnP zapnuté na routeru",
159         "type_network_public_ip_changed": "Veřejná IP adresa se změnila",
160         "type_network_upnp_port_mapping_added": "Nové mapování portu přes UPnP",
161         "type_radio_new_device_joined": "Připojeno nové rádiové zařízení",
162         "type_network_unknown_device_joined": "Nové zařízení v síti",
163         "type_network_guest_client_present": "Neověřené zařízení na hostovské Wi-Fi",
164         "type_network_guest_network_idle": "Hostovská Wi-Fi zapnutá bez využití",
165         "type_network_wpa3_disabled": "WPA3 je vypnuto",
166         "type_network_protection_disabled": "Blokování hrozeb na routeru je vypnuto",
167         "type_network_ddns_enabled": "Dynamické DNS je zapnuto",
168         "type_zwave_insecure_security_class": "Zařízení Z-Wave bez zabezpečení S2",
169         "type_zigbee_permit_join_open": "Párování Zigbee je otevřené",
170         "type_zwave_inclusion_active": "Začleňování Z-Wave je aktivní",
171         "type_radio_coordinator_update_pending": (
172             "K dispozici aktualizace rádiového koordinátoru"
173         ),
174         "subtitle_appliance_finished": "{appliance} dokončeno",
175         "subtitle_appliance_cycle_complete": "Cyklus spotřebiče dokončen",
176         "subtitle_entry_open_alarm_disarmed": "{entry_name} otevřeno, alarm vypnutý",
177         "subtitle_power_deviation": "{appliance}: odběr {direction}, než se čekalo",
178         "subtitle_reading_deviation": (
179             "{appliance}: hodnota {direction}, než se čekalo"
180         ),
181         "direction_lower": "nižší",
182         "direction_higher": "vyšší",
183         "fallback_entry": "Vstup",
184         "fallback_sensor": "Senzor",
185         "fallback_unknown_entity": "Neznámá entita",
186         "fallback_message": "{summary}: {entity}. {action_hint}",
187         "persistent_fallback": (
188             "{summary} (závažnost {severity}) pro {entities}. {hint}"
189         ),
190         "batch_title": "Novinka z domova",
191         "batch_message": "{count} novinek z domova: {type_summary}.",
192         "batch_more": "\u2026a dal\u0161\u00edch {count}",
193         "digest_title": "Denní přehled Sentinelu",
194         "digest_message": (
195             "Sentinel: {count} upozornění za posledních 24 h ({sev_summary})."
196         ),
197         "audit_report_title": "Zpráva z bezpečnostního auditu",
198         "audit_report_not_run": "Kontroly, které nebylo možné provést",
199         "audit_report_notes": "Poznámky",
200         "audit_report_other": "Ostatní",
201         "audit_report_truncated": (
202             "zkráceno; zbytek získáte službou run_network_audit."
203         ),
204         "severity_word_high": "vysoká",
205         "severity_word_medium": "střední",
206         "severity_word_low": "nízká",
207         "snooze_confirm_title": "Potvrdit trvalé ztlumení",
208         "snooze_confirm_message": (
209             "Trvale potlačit upozornění typu '{friendly}'? "
210             "Lze vrátit zpět pouze v nastavení."
211         ),
212         "action_hint_high": "Naléhavé: zkontrolujte a zajistěte to hned.",
213         "action_hint_medium": "Zkontrolujte brzy a zajistěte, pokud je to neobvyklé.",
214         "action_hint_low": "Projděte si to, až budete mít čas.",
215     },
216 }
217 
218 _DEFAULT_LANGUAGE = "en"
219 
220 
221 def _resolve_language(hass: HomeAssistant | None) -> str:
222     """Resolve the message language from the HA instance's configured language."""
223     if hass is None:
224         return _DEFAULT_LANGUAGE
225     # Guard the config attribute itself, not just language: notification
226     # dispatch must never crash on language resolution, and lightweight
227     # test doubles may not carry a config object at all.
228     config = getattr(hass, "config", None)
229     language = getattr(config, "language", None) or _DEFAULT_LANGUAGE
230     base = language.split("-", 1)[0].lower()
231     return base if base in _MESSAGES else _DEFAULT_LANGUAGE
232 
233 
234 def notif_msg(hass: HomeAssistant | None, key: str, /, **kwargs: Any) -> str:
235     """

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier_messages.py line 142
Likely real: Yes, 91% confidence

Possible hardcoded password: 'Nový administrátor nebo přístupový token'

141         ),
142         "type_ha_new_admin_or_token": "Nový administrátor nebo přístupový token",
143         "type_ha_long_lived_token_stale": "Starý dlouhodobý přístupový token",
144         "type_ha_failed_logins": "Neúspěšné pokusy o přihlášení",
145         "type_ha_cloud_remote_ui_enabled": "Vzdálený přístup přes cloud je zapnutý",
146         "type_ha_addon_exposed_port": "Port doplňku vystaven na hostiteli",
147         "type_ha_addon_unprotected": "Ochranný režim doplňku vypnutý",
148         "type_ha_webhook_automation_public": "Veřejná webhook automatizace",
149         "type_ha_trusted_networks_bypass_login": (
150             "Obejití přihlášení z důvěryhodné sítě"
151         ),
152         "type_ha_http_proxy_misconfigured": "Blokování IP adres vypnuté",
153         "type_security_device_unavailable": "Bezpečnostní zařízení nedostupné",
154         "type_network_unconfigured_discovered_device": (
155             "Nalezeno nenakonfigurované zařízení"
156         ),
157         "type_network_router_update_pending": "K dispozici aktualizace routeru",
158         "type_network_upnp_enabled": "UPnP zapnuté na routeru",
159         "type_network_public_ip_changed": "Veřejná IP adresa se změnila",
160         "type_network_upnp_port_mapping_added": "Nové mapování portu přes UPnP",
161         "type_radio_new_device_joined": "Připojeno nové rádiové zařízení",
162         "type_network_unknown_device_joined": "Nové zařízení v síti",
163         "type_network_guest_client_present": "Neověřené zařízení na hostovské Wi-Fi",
164         "type_network_guest_network_idle": "Hostovská Wi-Fi zapnutá bez využití",
165         "type_network_wpa3_disabled": "WPA3 je vypnuto",
166         "type_network_protection_disabled": "Blokování hrozeb na routeru je vypnuto",
167         "type_network_ddns_enabled": "Dynamické DNS je zapnuto",
168         "type_zwave_insecure_security_class": "Zařízení Z-Wave bez zabezpečení S2",
169         "type_zigbee_permit_join_open": "Párování Zigbee je otevřené",
170         "type_zwave_inclusion_active": "Začleňování Z-Wave je aktivní",
171         "type_radio_coordinator_update_pending": (
172             "K dispozici aktualizace rádiového koordinátoru"
173         ),
174         "subtitle_appliance_finished": "{appliance} dokončeno",
175         "subtitle_appliance_cycle_complete": "Cyklus spotřebiče dokončen",
176         "subtitle_entry_open_alarm_disarmed": "{entry_name} otevřeno, alarm vypnutý",
177         "subtitle_power_deviation": "{appliance}: odběr {direction}, než se čekalo",
178         "subtitle_reading_deviation": (
179             "{appliance}: hodnota {direction}, než se čekalo"
180         ),
181         "direction_lower": "nižší",
182         "direction_higher": "vyšší",
183         "fallback_entry": "Vstup",
184         "fallback_sensor": "Senzor",
185         "fallback_unknown_entity": "Neznámá entita",
186         "fallback_message": "{summary}: {entity}. {action_hint}",
187         "persistent_fallback": (
188             "{summary} (závažnost {severity}) pro {entities}. {hint}"
189         ),
190         "batch_title": "Novinka z domova",
191         "batch_message": "{count} novinek z domova: {type_summary}.",
192         "batch_more": "\u2026a dal\u0161\u00edch {count}",
193         "digest_title": "Denní přehled Sentinelu",
194         "digest_message": (
195             "Sentinel: {count} upozornění za posledních 24 h ({sev_summary})."
196         ),
197         "audit_report_title": "Zpráva z bezpečnostního auditu",
198         "audit_report_not_run": "Kontroly, které nebylo možné provést",
199         "audit_report_notes": "Poznámky",
200         "audit_report_other": "Ostatní",
201         "audit_report_truncated": (
202             "zkráceno; zbytek získáte službou run_network_audit."
203         ),
204         "severity_word_high": "vysoká",
205         "severity_word_medium": "střední",
206         "severity_word_low": "nízká",
207         "snooze_confirm_title": "Potvrdit trvalé ztlumení",
208         "snooze_confirm_message": (
209             "Trvale potlačit upozornění typu '{friendly}'? "
210             "Lze vrátit zpět pouze v nastavení."
211         ),
212         "action_hint_high": "Naléhavé: zkontrolujte a zajistěte to hned.",
213         "action_hint_medium": "Zkontrolujte brzy a zajistěte, pokud je to neobvyklé.",
214         "action_hint_low": "Projděte si to, až budete mít čas.",
215     },
216 }
217 
218 _DEFAULT_LANGUAGE = "en"
219 
220 
221 def _resolve_language(hass: HomeAssistant | None) -> str:
222     """Resolve the message language from the HA instance's configured language."""
223     if hass is None:
224         return _DEFAULT_LANGUAGE
225     # Guard the config attribute itself, not just language: notification
226     # dispatch must never crash on language resolution, and lightweight
227     # test doubles may not carry a config object at all.
228     config = getattr(hass, "config", None)
229     language = getattr(config, "language", None) or _DEFAULT_LANGUAGE
230     base = language.split("-", 1)[0].lower()
231     return base if base in _MESSAGES else _DEFAULT_LANGUAGE
232 
233 
234 def notif_msg(hass: HomeAssistant | None, key: str, /, **kwargs: Any) -> str:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier_messages.py line 61
Likely real: Yes, 76% confidence

Possible hardcoded password: 'Old long-lived access token'

60         "type_ha_new_admin_or_token": "New administrator or access token",
61         "type_ha_long_lived_token_stale": "Old long-lived access token",
62         "type_ha_failed_logins": "Failed login attempts",
63         "type_ha_cloud_remote_ui_enabled": "Cloud remote access enabled",
64         "type_ha_addon_exposed_port": "Add-on port exposed on host",
65         "type_ha_addon_unprotected": "Add-on protection mode off",
66         "type_ha_webhook_automation_public": "Public webhook automation",
67         "type_ha_trusted_networks_bypass_login": "Trusted network login bypass",
68         "type_ha_http_proxy_misconfigured": "IP banning disabled",
69         "type_security_device_unavailable": "Security device unavailable",
70         "type_network_unconfigured_discovered_device": "Unconfigured device discovered",
71         "type_network_router_update_pending": "Router update available",
72         "type_network_upnp_enabled": "UPnP enabled on router",
73         "type_network_public_ip_changed": "Public IP address changed",
74         "type_network_upnp_port_mapping_added": "New UPnP port mapping",
75         "type_radio_new_device_joined": "New radio device joined",
76         "type_network_unknown_device_joined": "New device on the network",
77         "type_network_guest_client_present": "Untrusted device on the guest Wi-Fi",
78         "type_network_guest_network_idle": "Guest Wi-Fi left on unused",
79         "type_network_wpa3_disabled": "WPA3 is off",
80         "type_network_protection_disabled": "Router threat blocking is off",
81         "type_network_ddns_enabled": "Dynamic DNS is on",
82         "type_zwave_insecure_security_class": "Z-Wave device without S2 security",
83         "type_zigbee_permit_join_open": "Zigbee pairing is open",
84         "type_zwave_inclusion_active": "Z-Wave inclusion is active",
85         "type_radio_coordinator_update_pending": "Radio coordinator update available",
86         "subtitle_appliance_finished": "{appliance} finished",
87         "subtitle_appliance_cycle_complete": "Appliance cycle complete",
88         "subtitle_entry_open_alarm_disarmed": "{entry_name} open, alarm disarmed",
89         "subtitle_power_deviation": "{appliance}: power {direction} than expected",
90         "subtitle_reading_deviation": "{appliance}: reading {direction} than expected",
91         "direction_lower": "lower",
92         "direction_higher": "higher",
93         "fallback_entry": "Entry",
94         "fallback_sensor": "Sensor",
95         "fallback_unknown_entity": "Unknown entity",
96         "fallback_message": "{summary}: {entity}. {action_hint}",
97         "persistent_fallback": "{summary} (severity {severity}) for {entities}. {hint}",
98         "batch_title": "Home Update",
99         "batch_message": "{count} home update{plural}: {type_summary}.",
100         "batch_more": "\u2026and {count} more",
101         "digest_title": "Sentinel Daily Digest",
102         "digest_message": (
103             "Sentinel: {count} alert{plural} in the last 24 h ({sev_summary})."
104         ),
105         "audit_report_title": "Security audit report",
106         "audit_report_not_run": "Checks that could not run",
107         "audit_report_notes": "Notes",
108         "audit_report_other": "Other",
109         "audit_report_truncated": (
110             "truncated; run the run_network_audit service for the rest."
111         ),
112         "severity_word_high": "high",
113         "severity_word_medium": "medium",
114         "severity_word_low": "low",
115         "snooze_confirm_title": "Confirm permanent snooze",
116         "snooze_confirm_message": (
117             "Permanently suppress '{friendly}' alerts? "
118             "This can only be undone from settings."
119         ),
120         "action_hint_high": "Urgent: check and secure it now.",
121         "action_hint_medium": "Check soon and secure it if unexpected.",
122         "action_hint_low": "Review when convenient.",
123     },
124     "cs": {
125         "severity_title_high": "Bezpečnostní výstraha",
126         "severity_title_medium": "Upozornění z domova",
127         "severity_title_low": "Novinka z domova",
128         "type_open_entry_while_away": "Otevřený vstup v nepřítomnosti",
129         "type_open_entry_at_night": "Otevřený vstup v noci",
130         "type_open_any_window_at_night_while_away": "Otevřené okno v noci",
131         "type_motion_detected_at_night_while_away": ("Pohyb v noci v nepřítomnosti"),
132         "type_motion_detected_while_away": "Pohyb v nepřítomnosti",
133         "type_unlocked_lock_at_night": "Zámek ponechán odemčený",
134         "type_camera_entry_unsecured": "Pohyb u nezajištěného vstupu",
135         "type_alarm_disarmed_during_external_threat": (
136             "Pohyb venku při vypnutém alarmu"
137         ),
138         "type_appliance_power_duration": "Doba provozu spotřebiče",
139         "type_ha_sensitive_entity_exposed_without_pin": (
140             "Citlivá entita zpřístupněna bez PIN"
141         ),
142         "type_ha_new_admin_or_token": "Nový administrátor nebo přístupový token",
143         "type_ha_long_lived_token_stale": "Starý dlouhodobý přístupový token",

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/explain/llm_explain.py line 153
Likely real: Yes, 76% confidence

Possible hardcoded password: 'Old long-lived access token'

152     "ha_new_admin_or_token": "New administrator or access token",
153     "ha_long_lived_token_stale": "Old long-lived access token",
154     "ha_failed_logins": "Failed login attempts",
155     "ha_cloud_remote_ui_enabled": "Cloud remote access enabled",
156     "ha_addon_exposed_port": "Add-on port exposed on host",
157     "ha_addon_unprotected": "Add-on protection mode off",
158     "ha_webhook_automation_public": "Public webhook automation",
159     "ha_trusted_networks_bypass_login": "Trusted network login bypass",
160     "ha_http_proxy_misconfigured": "IP banning disabled",
161     "security_device_unavailable": "Security device unavailable",
162     "network_unconfigured_discovered_device": "Unconfigured device discovered",
163     "network_router_update_pending": "Router update available",
164     "network_upnp_enabled": "UPnP enabled on router",
165     "network_public_ip_changed": "Public IP address changed",
166     "network_upnp_port_mapping_added": "New UPnP port mapping",
167     "radio_new_device_joined": "New radio device joined",
168     "network_unknown_device_joined": "New device on the network",
169     "network_guest_client_present": "Untrusted device on the guest Wi-Fi",
170     "network_guest_network_idle": "Guest Wi-Fi left on unused",
171     "network_wpa3_disabled": "WPA3 is off",
172     "network_protection_disabled": "Router threat blocking is off",
173     "network_ddns_enabled": "Dynamic DNS is on",
174     "zwave_insecure_security_class": "Z-Wave device without S2 security",
175     "zigbee_permit_join_open": "Zigbee pairing is open",
176     "zwave_inclusion_active": "Z-Wave inclusion is active",
177     "radio_coordinator_update_pending": "Radio coordinator update available",
178 }
179 
180 
181 def _display_type(finding: AnomalyFinding) -> str:
182     """
183     Friendly label for a finding.
184 
185     Dynamic rules carry slugified candidate IDs as ``finding.type``; when the
186     type has no curated label but the rule's template does, prefer the
187     template label so explanations never show raw candidate slugs
188     (issue #516 review).
189     """
190     if finding.type in _KNOWN_TYPE_LABELS:
191         return _KNOWN_TYPE_LABELS[finding.type]
192     template_id = str(finding.evidence.get("template_id") or "")
193     if template_id in _KNOWN_TYPE_LABELS:
194         return _KNOWN_TYPE_LABELS[template_id]
195     return _friendly_type(finding.type)
196

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/sentinel/notifier_messages.py line 60
Likely real: Yes, 69% confidence

Possible hardcoded password: 'New administrator or access token'

59         ),
60         "type_ha_new_admin_or_token": "New administrator or access token",
61         "type_ha_long_lived_token_stale": "Old long-lived access token",
62         "type_ha_failed_logins": "Failed login attempts",
63         "type_ha_cloud_remote_ui_enabled": "Cloud remote access enabled",
64         "type_ha_addon_exposed_port": "Add-on port exposed on host",
65         "type_ha_addon_unprotected": "Add-on protection mode off",
66         "type_ha_webhook_automation_public": "Public webhook automation",
67         "type_ha_trusted_networks_bypass_login": "Trusted network login bypass",
68         "type_ha_http_proxy_misconfigured": "IP banning disabled",
69         "type_security_device_unavailable": "Security device unavailable",
70         "type_network_unconfigured_discovered_device": "Unconfigured device discovered",
71         "type_network_router_update_pending": "Router update available",
72         "type_network_upnp_enabled": "UPnP enabled on router",
73         "type_network_public_ip_changed": "Public IP address changed",
74         "type_network_upnp_port_mapping_added": "New UPnP port mapping",
75         "type_radio_new_device_joined": "New radio device joined",
76         "type_network_unknown_device_joined": "New device on the network",
77         "type_network_guest_client_present": "Untrusted device on the guest Wi-Fi",
78         "type_network_guest_network_idle": "Guest Wi-Fi left on unused",
79         "type_network_wpa3_disabled": "WPA3 is off",
80         "type_network_protection_disabled": "Router threat blocking is off",
81         "type_network_ddns_enabled": "Dynamic DNS is on",
82         "type_zwave_insecure_security_class": "Z-Wave device without S2 security",
83         "type_zigbee_permit_join_open": "Zigbee pairing is open",
84         "type_zwave_inclusion_active": "Z-Wave inclusion is active",
85         "type_radio_coordinator_update_pending": "Radio coordinator update available",
86         "subtitle_appliance_finished": "{appliance} finished",
87         "subtitle_appliance_cycle_complete": "Appliance cycle complete",
88         "subtitle_entry_open_alarm_disarmed": "{entry_name} open, alarm disarmed",
89         "subtitle_power_deviation": "{appliance}: power {direction} than expected",
90         "subtitle_reading_deviation": "{appliance}: reading {direction} than expected",
91         "direction_lower": "lower",
92         "direction_higher": "higher",
93         "fallback_entry": "Entry",
94         "fallback_sensor": "Sensor",
95         "fallback_unknown_entity": "Unknown entity",
96         "fallback_message": "{summary}: {entity}. {action_hint}",
97         "persistent_fallback": "{summary} (severity {severity}) for {entities}. {hint}",
98         "batch_title": "Home Update",
99         "batch_message": "{count} home update{plural}: {type_summary}.",
100         "batch_more": "\u2026and {count} more",
101         "digest_title": "Sentinel Daily Digest",
102         "digest_message": (
103             "Sentinel: {count} alert{plural} in the last 24 h ({sev_summary})."
104         ),
105         "audit_report_title": "Security audit report",
106         "audit_report_not_run": "Checks that could not run",
107         "audit_report_notes": "Notes",
108         "audit_report_other": "Other",
109         "audit_report_truncated": (
110             "truncated; run the run_network_audit service for the rest."
111         ),
112         "severity_word_high": "high",
113         "severity_word_medium": "medium",
114         "severity_word_low": "low",
115         "snooze_confirm_title": "Confirm permanent snooze",
116         "snooze_confirm_message": (
117             "Permanently suppress '{friendly}' alerts? "
118             "This can only be undone from settings."
119         ),
120         "action_hint_high": "Urgent: check and secure it now.",
121         "action_hint_medium": "Check soon and secure it if unexpected.",
122         "action_hint_low": "Review when convenient.",
123     },
124     "cs": {
125         "severity_title_high": "Bezpečnostní výstraha",
126         "severity_title_medium": "Upozornění z domova",
127         "severity_title_low": "Novinka z domova",
128         "type_open_entry_while_away": "Otevřený vstup v nepřítomnosti",
129         "type_open_entry_at_night": "Otevřený vstup v noci",
130         "type_open_any_window_at_night_while_away": "Otevřené okno v noci",
131         "type_motion_detected_at_night_while_away": ("Pohyb v noci v nepřítomnosti"),
132         "type_motion_detected_while_away": "Pohyb v nepřítomnosti",
133         "type_unlocked_lock_at_night": "Zámek ponechán odemčený",
134         "type_camera_entry_unsecured": "Pohyb u nezajištěného vstupu",
135         "type_alarm_disarmed_during_external_threat": (
136             "Pohyb venku při vypnutém alarmu"
137         ),
138         "type_appliance_power_duration": "Doba provozu spotřebiče",
139         "type_ha_sensitive_entity_exposed_without_pin": (
140             "Citlivá entita zpřístupněna bez PIN"
141         ),
142         "type_ha_new_admin_or_token": "Nový administrátor nebo přístupový token",

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /custom_components/home_generative_agent/explain/llm_explain.py line 152
Likely real: Yes, 69% confidence

Possible hardcoded password: 'New administrator or access token'

151     "ha_sensitive_entity_exposed_without_pin": "Sensitive entity exposed without PIN",
152     "ha_new_admin_or_token": "New administrator or access token",
153     "ha_long_lived_token_stale": "Old long-lived access token",
154     "ha_failed_logins": "Failed login attempts",
155     "ha_cloud_remote_ui_enabled": "Cloud remote access enabled",
156     "ha_addon_exposed_port": "Add-on port exposed on host",
157     "ha_addon_unprotected": "Add-on protection mode off",
158     "ha_webhook_automation_public": "Public webhook automation",
159     "ha_trusted_networks_bypass_login": "Trusted network login bypass",
160     "ha_http_proxy_misconfigured": "IP banning disabled",
161     "security_device_unavailable": "Security device unavailable",
162     "network_unconfigured_discovered_device": "Unconfigured device discovered",
163     "network_router_update_pending": "Router update available",
164     "network_upnp_enabled": "UPnP enabled on router",
165     "network_public_ip_changed": "Public IP address changed",
166     "network_upnp_port_mapping_added": "New UPnP port mapping",
167     "radio_new_device_joined": "New radio device joined",
168     "network_unknown_device_joined": "New device on the network",
169     "network_guest_client_present": "Untrusted device on the guest Wi-Fi",
170     "network_guest_network_idle": "Guest Wi-Fi left on unused",
171     "network_wpa3_disabled": "WPA3 is off",
172     "network_protection_disabled": "Router threat blocking is off",
173     "network_ddns_enabled": "Dynamic DNS is on",
174     "zwave_insecure_security_class": "Z-Wave device without S2 security",
175     "zigbee_permit_join_open": "Zigbee pairing is open",
176     "zwave_inclusion_active": "Z-Wave inclusion is active",
177     "radio_coordinator_update_pending": "Radio coordinator update available",
178 }
179 
180 
181 def _display_type(finding: AnomalyFinding) -> str:
182     """
183     Friendly label for a finding.
184 
185     Dynamic rules carry slugified candidate IDs as ``finding.type``; when the
186     type has no curated label but the rule's template does, prefer the
187     template label so explanations never show raw candidate slugs
188     (issue #516 review).
189     """
190     if finding.type in _KNOWN_TYPE_LABELS:
191         return _KNOWN_TYPE_LABELS[finding.type]
192     template_id = str(finding.evidence.get("template_id") or "")
193     if template_id in _KNOWN_TYPE_LABELS:
194         return _KNOWN_TYPE_LABELS[template_id]
195     return _friendly_type(finding.type)

goruck / home-generative-agent

What we found, in plain English

Detections by engine

Score over time

Findings