Security

Home Assistant runs the locks, alarms, cameras, and heating of the people who use it. A security bug in Home Assistant is a bug in someone's front door. That is why security is not a separate team's problem here: it shows up in every integration, every card, every app, and every dependency bump.

This area is for everyone who contributes. You will find how to report a vulnerability, what to watch for in the code you write or review, and which checks already have your back.

• Security researchers and users who found something: start with Report a vulnerability.
• Integration developers: the code you write runs inside Core, with access to everything. The integration guide covers credentials, certificates, redaction, admin-only access, webhooks, and file paths.
• Frontend developers: names, attributes, and Markdown that reach the interface can come from anywhere. See untrusted content in the frontend.
• App developers: your app runs in its own container, next to the rest of the system. See Secure your app and the security rating, and the lessons from past advisories in secure apps.
• Companion app developers: the app holds the login of the user, so anything that can make it act on its own is a risk. See secure companion apps.
• Reviewers: you are the last pair of eyes before code reaches people's homes. See Review with security in mind.

• Your first contribution: check the diagnostics of an integration you use for data that should not be in there.
• How Home Assistant handles trust: who Home Assistant trusts, where it can be attacked, and what the system already does for you.
• Report a vulnerability: how to report, what qualifies, and what to expect.

• Secure integrations: the patterns and helpers that keep an integration safe.
• Untrusted content in the frontend: escaping, sanitizing, and safe links.
• Secure apps: what the advisories about apps and the Supervisor teach.
• Secure companion apps: links, exported components, the WebView, and the JavaScript bridge.
• Dependencies and supply chain: what Home Assistant asks of a library, and how it checks.
• Review with security in mind: what to look for in a pull request.

• Security helpers: every helper on one page, for Core and the frontend.
• Automated security checks: the tools that check code, dependencies, and workflows.
• Past advisories: every published advisory, grouped by kind, with what went wrong and the lesson.

• Authentication and permissions: users, tokens, and how to check what someone may do.
• Diagnostics: let users share data, without the secrets.
• Securing your Home Assistant: the user side, from passwords to remote access.

• A vulnerability: report it through a GitHub security advisory, never in public. The security.txt of the project lists [email protected] as its contact.
• Writing about the security of Home Assistant: the security policy asks you to get in touch at [email protected] first, so all claims can be checked.
• A question about writing secure code that is not a vulnerability: ask in the #developers channel on the Home Assistant Discord, or in your pull request. Can't see the channel? Under Channels & Roles, choose I want to contribute dev skills to Home Assistant.