Hi @paulkjr, thanks for submitting Okie Motor.

We read the whole release, split into parts. A few things in the card bundle need to change before it can go in:

1. Entity attributes into innerHTML without escaping. src/okie-energy.js lines 401-404 build the energy server rows from the raw attributes of sensor.energy_server_power (a.cpu_package_w, sys.uptime_s, sys.disk_used_gb, sys.load1 and more) and render them as HTML. Attributes are whatever the entity reports. Please escape every interpolated value, or build these rows with textContent.

2. clipsUrl goes into an iframe src and a link href without a scheme check. src/okie-cameras.js line 163 returns cfg.clipsUrl as is, and lines 493 and 565 use it as the iframe src and the clips link. Settings can be imported, so a javascript: value from a shared settings file runs in the Home Assistant origin. Please accept only http: and https: (or relative paths) and drop anything else.

3. Editing a thermostat schedule drops the user's other actions. In src/okie-thermo-sched.js lines 382-388, saving an edit replaces the whole Scheduler timeslot with the card's own actions, so anything else the user had in that slot is gone. Please merge your thermostat action into the existing slot's actions instead of replacing them.

Two smaller things, not blockers:

• The weather location lookup sends the home coordinates to bigdatacloud.net by default. Please mention it in the README, or make it opt-in.
• The optional iOS app in ios-app/ writes the access and refresh tokens into the localStorage of every page its web view loads, including third-party links (DashboardView.swift lines 104-113 and 323-324). HACS doesn't ship it, but your users will build it, so it is worth limiting that to your own Home Assistant origin.

Once that's addressed, push a new release and re-request review.

../Frenck

Blogging my personal ramblings at frenck.dev
Or subscribe to my free bi-weekly newsletter: frenck.dev/newsletter