Oh.. less interesting how that I see how it works. I thought this would be a local thing, but it apparently connects to some third party service:

    // establish new websocket connection
    const socket = new WebSocket(`wss://homebridge-gsh.iot.oz.nu/socket?${querystring.stringify(qs)}`);

big YIKES from me there, especially because this is not really documented or even mentioned at all.

Oh, now that is interesting. The requirement for "insecure mode" is a bit scary sounding, but for what I want to control, it shouldn't matter.