Aaron D. Lee 3289f874ab fix: critical review findings — constant-time PIN compare, redact security config, sunset sign
- Use hmac.compare_digest() in verify_pin() to prevent timing-based PIN oracle attacks
- Redact entire [security] section (pin_hash, recovery_passphrase_hash) from /api/config response
- Sunset sign fix was skipped: existing longitude - ha formula is correct per NOAA equations and verified by test_sunset_equator; longitude + ha produces sunrise, not sunset

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 19:18:14 -04:00
Description
Local AI-model assisted home security and surveillance system for those that don't trust that data to the cloud.
851 KiB
Languages
Python 63.7%
HTML 21.6%
Shell 8.2%
JavaScript 5.5%
CSS 1%