Home Assistant serves config/www without authentication

Files in the www directory of a Home Assistant configuration are served at /local/ to anyone who can reach the server. No login is involved. That is how custom dashboard cards load their assets, and it is easy to forget when writing an integration.

My LG integration had a button that took a screenshot of the TV and saved it under www so a dashboard could show it. That published whatever was on the television to the local network, and to the internet for an instance exposed there. A review pointed it out and the button was removed.

The same review led to checking every path the integration accepts from a user, the screenshot filename and the notification icon, against Home Assistant’s is_allowed_path before using it.