The Permission Gap: Home Assistant’s Secret Scanning and the API Trust Deficit

A recent conflict within the Home Assistant community highlights a critical friction point in the 'permission economy': when does a security feature become an unauthorized backdoor for data transmission?

As first reported via a GitHub thread highlighted by Hacker News, a user identified as Viss raised alarms regarding a mechanism in Home Assistant version 2026.10.1 that scans system secrets and transmits data to a third party. Viss, who identifies as a red-teamer and the head of Phobos Group, characterized the action as a "severe invasion of privacy," arguing that the system performed these scans without explicit user authorization. Viss further argued that such a mechanism could be exploited by malicious actors with access to Home Assistant GitHub repositories to loot credentials globally.

Responding to the claims, Home Assistant member frenck clarified that the feature is not new and has existed within the Supervisor for years. Frenck explained that the system identifies app options marked as passwords, hashes them locally, and sends only the first five characters of the hash to verify if they appear in leaked password databases. Frenck cited k-anonymity and referred to Cloudflare's documentation on validating leaked passwords to argue that passwords are never published or sent out in full.

Despite these safeguards, friction remains over transparency. Frenck admitted that a recent release fixed a warning that surfaced the feature, which is why users like Viss only recently became aware of it. While frenck noted that the check can be disabled via the command `ha security options --pwned=false`, other users, including 0x00string, described the response to privacy concerns as "extremely dismissive" and called for a formal method to disable the feature. The exchange grew so heated that the thread was eventually locked, with frenck closing the issue as "won't fix" on the grounds that the repository was for documentation rather than feature requests.

**Opinion:** This is a textbook example of the 'security paradox.' By implementing a background check to protect users from 'hackable' secrets, Home Assistant created a new vulnerability: a breach of trust. When third-party API access is mandated rather than requested, it ceases to be a feature and becomes a liability. In an era where data sovereignty is a primary asset, 'opt-out' security is a flawed architecture.