Found something that lets someone else move a desk, read a panel or put firmware on one? Please report it privately, with GitHub's Report a vulnerability button on this repository's Security tab, not in a public issue.

This is a hobby project for my own desk, so there is no promise of when a fix comes. The panel's HTTP endpoints, its update and Claude keys and the companion's Bluetooth link are meant for a home network and a room you trust: the keys travel over plain HTTP, and the companion does not pair yet.