Skip to content

SECURITY.md

Latest commit

 

History

History
107 lines (82 loc) · 3.62 KB

SECURITY.md

File metadata and controls

107 lines (82 loc) · 3.62 KB

Security Guidelines for ha-saxo

This document outlines security best practices for users and developers of the Saxo Portfolio Home Assistant integration.

User Security Guidelines

1. Application Credentials Management

  • Always use the simulation environment initially to test the integration
  • Create dedicated application credentials specifically for Home Assistant
  • Never share your App Key or App Secret with others
  • Store credentials securely using Home Assistant's Application Credentials system
  • Rotate credentials periodically (recommended every 6 months)

2. OAuth Token Security

  • OAuth tokens are automatically encrypted and stored in Home Assistant's config entries
  • Tokens are automatically refreshed before expiration
  • Never manually copy or store OAuth tokens outside of Home Assistant
  • If you suspect token compromise, revoke access in the Saxo Developer Portal

3. Network Security

  • Ensure Home Assistant instance uses HTTPS (SSL/TLS) for external access
  • All API communication with Saxo uses HTTPS with certificate verification
  • The integration respects Saxo's rate limits to prevent abuse

4. Environment Separation

  • Start with simulation environment before switching to production
  • Simulation environment uses https://gateway.saxobank.com/sim/openapi
  • Production environment uses https://gateway.saxobank.com/openapi
  • Environment selection is enforced at both authentication and API levels

5. Data Protection

  • Portfolio data is only stored temporarily in Home Assistant's memory
  • No sensitive financial data is logged in debug messages
  • Error messages are sanitized to prevent information leakage

Developer Security Guidelines

1. Credential Handling

# ✅ CORRECT - Use application credentials system
credentials = await async_get_application_credentials(hass, DOMAIN)
app_key = credentials.client_id

# ❌ WRONG - Never hardcode credentials
app_key = "hardcoded_key"

2. Error Handling

# ✅ CORRECT - Log error type, not details
_LOGGER.error("Authentication failed: %s", type(e).__name__)

# ❌ WRONG - Could leak sensitive information
_LOGGER.error("Authentication failed: %s", str(e))

3. API Security

  • Always use HTTPS endpoints
  • Implement proper SSL certificate verification
  • Include rate limiting with exponential backoff
  • Use secure random state parameters for OAuth

4. Token Management

  • Access tokens should only be retrieved from config entries
  • Implement token refresh before expiration
  • Use secure storage provided by Home Assistant
  • Log token operations at debug level only

Security Testing

Automated Security Checks

The integration includes:

  • SSL certificate verification enforcement
  • OAuth state parameter validation
  • Rate limiting implementation
  • Sanitized error logging

Manual Security Review

Regularly review:

  • Application credentials in Saxo Developer Portal
  • Home Assistant access logs
  • Integration error logs
  • OAuth token expiration and refresh

Incident Response

If you discover a security vulnerability:

  1. Do not create a public GitHub issue
  2. Email security concerns to the maintainers
  3. Provide detailed information about the vulnerability
  4. Allow reasonable time for investigation and fix

Compliance

This integration follows:

  • OAuth 2.0 security best practices
  • Home Assistant security guidelines
  • Industry standard rate limiting
  • Secure credential management patterns

Updates

  • Security guidelines: Last updated 2025-09-10
  • Next review scheduled: 2026-03-10

For questions about security practices, consult the Home Assistant security documentation or contact the integration maintainers.