i never authorized an integration that scans my secrets

DescriptionType of issue Other (issue in content formatting, broken link or image, non-working widget) Problem description This is a pretty severe invasion of privacy. I never authorized any integrations or plugins for scanning secrets and sending them up the line, even if they are hashed or not. This mechanism could be abused by a malicious threat actor with access to the home assistant github repos in a variety of ways. how do i turn this thing off? Suggested solution make this an opt-in feature, do not just opt people in to scanning for secrets with a system they were not aware existed. URL https://www.home-assistant.io/more-info/pwned-passwords/ Version 2026.10.1 How do you know the suggested solution is correct? No response Additional information No responseActivityfrenck commented on Oct 16, 2026 MemberOh hi there 👋 It is not an invasion of privacy and there are sure other apps out there doing this (most notably the 1Password password manager). Your passwords are never send out, never published. Read more about it here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ As a matter of fact, it is designed to handled these types of data with privacy in mind, see also: https://en.wikipedia.org/wiki/K-anonymity If anything, learn from the output, because the secrets you are using are listed in the password databases and thus easily "hackable". ../Frenck Blogging my personal ramblings at frenck.devReacted by xor eax,eaxViss commented on Oct 16, 2026 AuthorI run Phobos Group, and I travel all over the world giving presentations about security. I am very well acquainted with HIBP, and have met troy in the past. I helped deploy 1password at twitter when I was their sole red-team staff member in 2011. I am still not happy that home assistant, without my opt-in, without my permission, scanned my HA installation and send stuff up the line to HIBP. This should be an opt-in feature, and not something that 'just happens'. As a red teamer, I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.Reacted by Daniel W. CromptonViss commented on Oct 16, 2026 Authorthis issue is not closed until I am satisfied that HA is not taking things off my system without my permission and sending them to a 3rd partyReacted by Daniel W. Cromptonfrenck commented on Oct 16, 2026 MemberThis issue is closed as won't fix. Sorry. ../FrenckReacted by Latte macchiatoReacted by Ryan Carter, Ben Lee, Ciarán Ainsworth, Daniel W. Crompton, xor eax,eax and Jamie Bliss0x00string commented on Oct 16, 2026 Hi, long time HA user here. Please re-open this issue and address the question of how to disable this. If a method to disable it is not currently implemented, please consider implementing this rather than insisting the userbase accept this and take your word on it. This response feels extremely dismissive and as a user of this platform I feel secondhand offended by it as I share the exact same concerns as OP and do not believe the response here adequately addressed the concerns. If there is no interest in addressing this reasonably, please let us know so we can uninstall and fork.Reacted by Daniel W. CromptonReacted by Justin Myersfrenck commented on Oct 16, 2026 Member please let us know so we can uninstall and fork Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a feature request, that is fine, we have places for that. This report is on our documentation. There is no amount of documentation I can adjust to adjust this or address this. Thus closed as won't fix. If this is all reason for you to uninstall and fork... 🤷 So be it, it is open source after all. ../Frenck Blogging my personal ramblings at frenck.devtroed commented on Oct 16, 2026 It is not an invasion of privacy Yes. Yes it is. /whitehat hackerlocked as too heated and limited conversation to collaborators on Oct 16, 2026