Home Assistant Scans Your Secrets Without Permission, Maintainer Closes Issue as Won't Fix
I never authorized an integration that scans my secrets
A security researcher and Home Assistant user filed a GitHub issue complaining that the platform scans for secrets and sends hashed passwords to Have I Been Pwned without opt-in. Maintainer frenck dismissed the privacy concern, citing k-anonymity, and closed the issue as won't fix, sparking backlash from users who want an opt-out.
As a red teamer, I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.