i by no means licensed an integration that scans my secrets and techniques · Situation #49314 · home-assistant/home-assistant.io · GitHub

Leaving this closed since this repository is for our documentation, however I wish to comply with up, as a result of my earlier replies have been extra dismissive than this deserved. My apologies.

As it seems, this verify can already be turned off in any case:

ha safety choices --pwned=false

To be clear: this verify is not new, it has been a part of the Supervisor for years. It checks app choices which are marked as passwords. A latest launch mounted the warning that surfaces it, which is why you are seeing it now.

Privacy was a design requirement for this function from the beginning, which is why your secrets and techniques by no means go away your system. The Supervisor hashes them domestically and sends solely the primary 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns each hash beginning with that prefix, and the matching occurs by yourself occasion. You can see precisely what it does right here: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py

You are proper that our documentation ought to have defined this, together with methods to flip it off. We’ll get that web page up to date.

../Frenck

Blogging my private ramblings at frenck.dev