-
Notifications
You must be signed in to change notification settings - Fork 3
Security and Privacy
- Home Assistant owns Bluetooth adapters, ESPHome proxy credentials, slot allocation, config-entry storage, and entity authorization.
- The integration uses Home Assistant's documented Bluetooth manager and never
contacts a proxy directly or reads Home Assistant
.storage. - Bluetooth and cloud operations have bounded timeouts and connection cleanup.
- The integration is read-only and exposes no general-purpose command or GATT API.
Setup generates a random companion ID, cloud device password, and transient pairing value. It does not request a Weber email or password, copy a phone credential, intercept TLS, or require a packet capture.
The companion is registered before physical approval so the hub can publish its association during that one-time session. Abandoning setup after registration may leave an unused companion record at Weber because no supported revocation endpoint is available.
The default mode uses HTTPS and WSS to send only companion registration and authentication, exact-hub association checks, messaging wake-up, status subscription, and current-status requests. Version 3.0 has no recipe, cook history, instruction, timer, target, or remote-control request path.
Home Assistant stores the approved companion credential and hub configuration in its config entry. The transient pairing value is discarded.
Downloaded diagnostics redact the hub address, appliance and companion IDs, cloud password, keys, and tokens. Never publish config-entry exports, complete MAC addresses, Weber account details, packet captures, or unredacted diagnostics.
Use the repository's private Report a vulnerability flow. If private advisories are unavailable, open an issue requesting maintainer contact without including technical details.