Security guides
How to keep the code you write or review safe, per kind of contribution.
Each guide covers one kind of contribution. They build on how Home Assistant handles trust, so read that first if you have not yet.
- Secure integrations: credentials, certificates, redaction, admin-only access, webhooks, and file paths.
- Untrusted content in the frontend: escaping, sanitizing, and safe links.
- Secure apps: what the advisories about apps and the Supervisor teach.
- Secure companion apps: links, exported components, the WebView, and the JavaScript bridge.
- Dependencies and supply chain: what Home Assistant asks of a library, and how it checks.
- Review with security in mind: what to look for in a pull request, and what to do when you find something.