Readiness report
Mycodo Environmental Monitoring · 2026-09-03 18:32 · complete · 6 searches, 9 pages fetched
Cybersecurity — software & network: Review before networking · 10 findings
Details in the Cybersecurity section of the report below.
Readiness: Mycodo Environmental Monitoring
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $126–$340 Cybersecurity — software & network: Review before networking
This is the cold check for this lab — there is no previous readiness report, so the prices and sellers below establish the baseline that future checks will measure drift against. The bill of materials is unusually small: the Mycodo distribution ships no PCB files, no schematics and no component-level parts list, so the only hardware this lab strictly requires is a Raspberry Pi single-board computer and a storage card, both mass-produced commodity items available today from many independent sellers. Nothing is discontinued, out of stock or unobtainable, and no substitute is needed. The caveats are about ordering carefully rather than about scarcity: the cheapest search results are starter kits and Compute Modules rather than bare boards, most listings do not state RAM size or card capacity, the same Raspberry Pi 5 board spans $175 to $290 across sellers, and Raspberry Pi's own product pages block automated fetching so no manufacturer-side price or production-longevity statement is on this run's record. Sensors, relay boards and actuators are explicitly user-selected in this lab and are not part of the checked bill of materials.
Action required
None — all checked parts are sourceable.
Cybersecurity — software & network
Review before networking — Every dependency the project pins was checked and only minor, non-applicable advisories came back, but the web interface runs as root behind a self-signed certificate and the InfluxDB release is unpinned, so the device should be isolated and reviewed before it goes on a shared network.
| Component | Version | How known | Support status |
|---|---|---|---|
| Mycodo Environmental Regulation System | 8.17.0 | inferred (stated in the lab's README.rst per the snapshot; README.rst was not re-fetched this run, and the upstream repository's default branch (master) is the 8.17.0 line) | — |
| Raspberry Pi OS (Debian 13 ‘Trixie’ base) | 13 | inferred (stated in the lab's README.rst per the snapshot; not re-fetched this run) | supported until 2028-08-09 |
| InfluxDB — 2.x line (installer default on 64-bit) | 2 | inferred (install/setup.sh offers “Install Influxdb 2.x (recommended)” and pins no patch release (fetched/02-setup.sh)) | supported |
| InfluxDB — 1.x line (required on 32-bit hosts) | 1 | inferred (install/setup.sh offers “Install Influxdb 1.x” and pins no patch release (fetched/02-setup.sh)) | supported |
| Flask | 3.1.2 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| Werkzeug | 3.1.4 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| gunicorn | 23.0.0 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| requests | 2.32.5 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| setuptools | 80.9.0 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| filelock | 3.20.1 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| Flask_Talisman | 1.1.0 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| Flask_Login | 0.6.3 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| bcrypt | 5.0.0 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| pyro5 | 5.16 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| influxdb_client[ciso] | 1.49.0 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| SQLAlchemy | 2.0.45 | read from project (pinned in install/requirements.txt (fetched/01-requirements.txt)) | — |
| SQLite | not determined | not determined (no version is stated in the lab's documentation; SQLite is supplied by the host OS) | — |
| Bundled frontend web assets (Bootstrap, Date Range Picker, FontAwesome, gridstack.js, Highcharts, jQuery, toastr) | not determined | not determined (acknowledged in README.rst without version numbers; vendored into the distribution) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| filelock 3.20.1 | A time-of-check/time-of-use symlink flaw in SoftFileLock lets someone with a local account on the Pi redirect a lock file, which matters most on a shared classroom device. — GHSA-qmgc-5h2g-mvrw | moderate | No — project pins filelock==3.20.1; the fix is in 3.20.3. |
| requests 2.32.5 | The advisory describes insecure reuse of a temporary file inside the extract_zipped_paths() helper — a local issue on the device, not something reachable from the web interface. — GHSA-gc5v-m9x4-r6x2 | moderate | No — project pins requests==2.32.5; the fix is in 2.33.0. |
| setuptools 80.9.0 | The advisory covers a MANIFEST.in exclusion bypass when building source distributions on macOS filesystems; this lab installs on Raspberry Pi OS and does not build source distributions. — GHSA-h35f-9h28-mq5c | moderate | No — project pins setuptools==80.9.0; the fix is in 83.0.0. |
| Werkzeug 3.1.4 | Both advisories concern Werkzeug's safe_join() accepting Windows special device names, so they cannot be triggered on the Linux host this lab runs on. — GHSA-29vq-49wr-vm6x, GHSA-87hc-h4r5-73f7 | moderate | No — project pins Werkzeug==3.1.4; the fixes are in 3.1.5 and 3.1.6. |
| Flask 3.1.2 | Flask omits a “Vary: Cookie” header on some session accesses, so a caching proxy placed in front of the web interface could hand one user's page to another. — GHSA-68rp-wp8r-4726 | low | No — project pins Flask==3.1.2; the fix is in 3.1.3. |
| HTTPS certificate | The installer generates the HTTPS certificate itself and nginx serves it from the application's own ssl_certs directory, so the certificate is self-signed: browsers will warn, and nothing proves to a user on the network that they reached the right device. | posture | Mitigation only — expect the browser warning, or replace the generated certificate with one issued by the institution. |
| InfluxDB | The installer lets the user choose the 1.x or 2.x line but pins no specific release, so whatever patch version the vendor repository serves on install day is what runs and its security state cannot be checked from the project files. | posture | Mitigation only — record the installed version after setup (influxd version) and keep the database port reachable only from the host. |
| Installation method | Mycodo is installed by downloading a script from kizniche.github.io and running it with root privileges, so the install trusts whatever that URL serves on the day it is run. | posture | Mitigation only — download the installer, read it, and run it from a checked-out release rather than piping it straight into a shell. |
| Mycodo web interface (Gunicorn/Flask) | The systemd unit that runs the web interface sets User=root, so the whole web application runs with full administrative rights on the device. | posture | Mitigation only — keep the device on its own isolated lab network segment and off any open or campus-wide network. |
| nginx site configuration | The bundled nginx site listens on plain HTTP port 80 as well as HTTPS port 443 with no redirect in the server block; the HTTPS-only behaviour the documentation describes comes from Flask_Talisman inside the application rather than from the web server. | posture | Mitigation only — confirm the HTTP-to-HTTPS redirect actually fires before connecting the device to a shared network. |
What this means for your lab
Mycodo puts a web dashboard on the network that can switch relays and read every sensor the lab is wired to, and the service behind that dashboard runs as root on the Raspberry Pi. Anyone who can reach the device's address and get past the login can therefore turn outputs on and off, read and export the logged data, and change the automation rules; if they got past the web application itself they would have the whole device. The good news is that Mycodo does not ship a default password — it makes you create the admin account on first visit — so set a strong one at that prompt and do not reuse it. The HTTPS certificate is generated by the installer rather than issued by anyone, so your browser will warn you and there is nothing to confirm you are talking to the right board; treat that as normal here but do not rely on it to protect a password on an untrusted network. The dependency versions the project pins are current enough that the only advisories found are minor ones that do not apply to a Linux device or are not reachable from the web interface, and the operating system is still in support. The practical advice: put the Pi on an isolated lab network or VLAN rather than the general campus network, talk to campus IT before giving it a routable address, note the InfluxDB version the installer chooses so it can be checked later, and review the install script before running it as root.
Not checked
- Mycodo application code (8.17.0): no vulnerability database covers the Mycodo project itself, so only its Python dependencies were checked, never the application's own code
- SQLite: no version is stated in the lab's documentation, so no advisory lookup was possible
- Bundled frontend web assets (Bootstrap, Date Range Picker, FontAwesome, gridstack.js, Highcharts, jQuery, toastr): vendored into the distribution with no version numbers recorded, so no advisory lookup was possible
- Flask_Profiler 1.8.1: commented out in install/requirements.txt, so it is not installed and was not checked
- Debian system packages installed by apt: install/setup.sh delegates package installation to mycodo/scripts/upgrade_commands.sh, which was not fetched this run; their versions come from the Debian repositories rather than the project
Parts
Bill of Materials
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Raspberry Pi Single Board Computer (Model 3, 4 or 5) | 85 × 56 mm SBC, 40-pin 2.54 mm male header; 5.0 V DC in (micro-USB on Pi 3, USB-C on Pi 4/5); 3.3 V CMOS GPIO, not 5 V tolerant | readily available | not reported by retail listings | $100.00 — Pi 4 Model B, DigiKey · $289.99 — Pi 5 8GB, Micro Center | Google Shopping, 2026-09-03 |
| Host Storage Medium (MicroSD card or SSD) | MicroSD Class 10 / UHS-I or better, 16 GB minimum; high-endurance recommended for continuous logging | readily available | not reported by retail listings | $25.98 — SanDisk High Endurance, Walmart (Newegg Inc.) | Google Shopping, 2026-09-03 |
Raspberry Pi — what the search actually returned. Bare-board listings: $175.00 PiShop USA, $199.00 AAAwave, $210.00 Elecrow and $289.99 Micro Center for the Pi 5, and $100.00 DigiKey for the Pi 4 Model B. Only the Micro Center row states its RAM (8 GB) — Google Shopping ignored the "8GB" in the query, so check RAM on the seller's page before ordering. Cheaper hits are not bare boards: $61.05 Vilros and $121.95 Neobits are starter kits, and the Compute Module 5 ($165.00) and CM4 ($105.99) that also appeared are a different form factor with no 40-pin header — they do not meet this lab's footprint requirement.
MicroSD — what the search actually returned. $25.98 SanDisk High Endurance, $30.37 Kingston High Endurance, $35.99 SanDisk MAX Endurance, $39.00 Transcend High Endurance 350V and $50.10 Kingston at Best Buy. No listing states its capacity in the title, so pick 32 GB or larger at the seller. A $20.99 generic Class 10 card also appeared — it is not a high-endurance part, and continuous 24/7 sensor logging is exactly the write pattern high-endurance cards exist for.
Substitutes
None needed.
Other dependencies
- Fabrication: not required. The snapshot records no PCB design files, Gerber archives, drill files or mechanical drawings in this upload; assembly is connecting off-the-shelf sensor and relay modules to the Raspberry Pi.
- Upstream source repository — https://github.com/kizniche/Mycodo: reachable this run. Listed successfully via the GitHub API; default branch
master, 14 entries at the repository root. - Installer URL — https://kizniche.github.io/Mycodo/install: reachable this run. Responded with a 1449-byte payload (Content-Type
application/octet-stream). - Custom module repository — https://github.com/kizniche/Mycodo-custom: not checked — not dispatched this run; optional for the base lab.
- Documentation site — https://kizniche.github.io/Mycodo and https://kizniche.github.io/Mycodo/mycodo-api.html: not checked — not dispatched this run.
- Community translation platform — http://translate.kylegabriel.com: not checked — not dispatched this run; it is not required to run the lab, and it is a plain-HTTP host.
- Raspberry Pi official product pages — https://www.raspberrypi.com/products/raspberry-pi-5/ and .../raspberry-pi-4-model-b/: could not be fetched. Both were attempted and returned nothing (the site blocks automated fetching), so official pricing, the board's power-supply rating and any production-longevity commitment are not on this run's record. The electrical constraints in this report come from the lab's own snapshot.
Watch list
- Raspberry Pi 5 price spread. $175 to $290 for the same board across sellers this run — the widest variance in the whole bill of materials, and the number most likely to have moved by the next check. Budget from a bare-board listing, not from the cheapest search hit.
- Kit-versus-board confusion. Several of the lowest-priced results are starter kits or Compute Modules. If a future check reports a sudden price drop, verify it is still the same product before trusting it.
- Raspberry Pi 4 Model B availability. Priced here at $100.00, but it is the older generation of a family whose current model is the Pi 5; worth re-checking that bare Pi 4 boards are still stocked at retail rather than only appearing inside kits.
- RAM and capacity opacity. Retail listings for both bill-of-materials lines routinely omit RAM size and card capacity, so drift measurement on these two rows is only as good as the listing titles. Treat a large price change as a prompt to re-read the listing.
- No distributor-side data on either line. Neither part carries a manufacturer part number in the snapshot, so there is no lifecycle status or stock figure behind these verdicts — only retail listings. A future check would gain a lot from recording the DigiKey part numbers for the specific Raspberry Pi variants this lab standardises on.