Open a private security advisory on this repository, or email the maintainers. Please do not file a public issue for anything exploitable.

This repository is a development and demonstration stack. Everything it contains is meant to run on localhost. The notes below exist so that a reader can tell at a glance which committed material is deliberately public and which would be a real finding.

Development TLS material — apps/ocpp-server/src/assets/certificates/ and apps/ocpi-server/src/assets/certificates/

These are self-signed test certificates and their private keys, inherited from the upstream CitrineOS project, where they are also committed. They exist so the OCPP security profiles 2 and 3 (TLS, mutual TLS) can be exercised locally and in CI without provisioning a PKI.

They are trusted by nothing. They protect nothing. Publishing them discloses no access to any system.

A production deployment must not use them. Generate a real chain, mount it at the paths configured under util.certificateAuthority / util.networkConnection.tls* in the server config, and keep the private keys out of source control.

Local demo credentials — apps/operator-ui/.env.example, apps/operator-ui/.env.test

admin@uzgrid.uz / UzGrid!, and the Hasura/Postgres defaults in docker-compose.yml (uzgrid / uzgrid). These are published so that pnpm uzgrid yields a working login on a fresh clone, and so the Playwright suite runs with no configuration. They are documented, not confidential.

docker-compose.yml binds Postgres, RabbitMQ, MinIO, and Hasura to localhost for development. Exposing this stack on a public interface with these defaults would hand over the database — change every credential first.

apps/operator-ui/.env.local is git-ignored. scripts/stack.mjs creates it from .env.example on first run and generates a fresh NEXTAUTH_SECRET per install, so no session-signing key is ever shared between deployments. Put real credentials only here, or supply them through your orchestrator's secret store.

Database dumps written by scripts/migrate-db-to-uzgrid.sh land in backups/, which is git-ignored — they contain operational data.

These are tracked, not hidden:

• Charging station passwords are passed through in plain. OCPP 1.6 basic auth credentials are not yet stored hashed. This is the top item before any deployment that onboards third-party operators.
• TLS for OCPP security profiles 2 and 3 works locally against the test chain above but has not been validated against production hardware.
• Hasura runs without an admin secret in the default compose file, relying on the stack being localhost-only. Set HASURA_GRAPHQL_ADMIN_SECRET and the matching HASURA_ADMIN_SECRET before exposing it.