- Published on
I never authorized an integration that scans my secrets
- Authors
- Name
- DeepHorus
A Home Assistant user has publicly accused the project of unauthorized privacy invasion after discovering that its Supervisor component scans application secrets and checks them against the Have I Been Pwned password database. The complaint, filed as issue #49314 on the Home Assistant GitHub repository, concerns version 2026.10.1. The user said they never authorized any integration or plugin to scan secrets and send them up the line, even if hashed. The issue quickly drew attention from maintainers and other users.
The check in question is not new. Home Assistant maintainer Frenck explained that it has been part of the Supervisor for years. It examines app options marked as passwords and surfaces warnings when those passwords appear in known breach databases. A recent release fixed the warning that displays this check, which is why the user noticed it now. The feature is designed to use k-anonymity: the Supervisor hashes secrets locally and sends only the first five characters of the hash to the Have I Been Pwned API, meaning full passwords never leave the system.
Frenck initially closed the issue as won't fix, but later followed up with an apology for earlier dismissive replies. He confirmed that the check can be disabled with the command ha security options --pwned=false. He also said privacy was a design requirement from the start and compared the mechanism to 1Password, which uses a similar k-anonymity approach. A Cloudflare blog post and Wikipedia entry on k-anonymity were cited to explain the privacy model.
The reporter, who said they run Phobos Group and have worked as a red teamer, remained unsatisfied. They argued that Home Assistant scanned their installation and sent data to a third party without opt-in. They warned that a malicious actor with access to Home Assistant GitHub repositories could abuse the mechanism to loot credentials from installations worldwide. They demanded the feature be made opt-in rather than enabled by default.
Other users joined the thread, asking maintainers to reopen the issue and provide a clear way to disable the check. One long-time user said the response felt dismissive and threatened to uninstall or fork the project if concerns were not addressed. Frenck replied that such threats were not statements the project could work with. The issue remains closed, but the debate highlights growing tension over telemetry, security defaults, and user consent in open-source home automation.
The Supervisor check can already be turned off, but the controversy may push Home Assistant to document the feature more prominently or consider opt-in controls. For now, users who want to disable it can run the command. The incident underscores how security features that rely on external APIs can trigger privacy concerns even when they use privacy-preserving techniques.
