A Home Assistant user has raised a serious privacy concern about an integration that scans secrets and sends them externally, even when hashed. The user states they never authorized any integrations or plugins for scanning secrets and sending them up the line.
The mechanism could be abused by a malicious threat actor with access to the Home Assistant GitHub repositories in various ways. The user is asking how to turn the feature off.
The suggested solution is to make this an opt-in feature rather than automatically opting people into scanning for secrets with a system they were not aware existed. The issue references version 2026.10.1 and points to the Home Assistant more-info page on pwned passwords.
No additional information or confirmation that the suggested solution is correct was provided.
Source: Hacker News · Summarized by HeadlinesBriefing