HaCasa Nova runs in the Home Assistant frontend with the rights of the logged-in user. It has no server part of its own and stores its settings in Home Assistant's per-user frontend storage.
Please don't open a public issue for security problems. Report them privately via Security → Report a vulnerability on this repository, or send a direct message to @damianeickhoff.
You'll get a reply as soon as possible. Once a fix is released, the report can be made public with credit to you if you like.
Only the latest release of HaCasa Nova receives fixes. HaCasa v2 (the legacy branch) is no longer maintained.