Report a vulnerability

Found a security vulnerability in Home Assistant? Thank you for taking the time. This page sums up the official security policy, section by section, with a link to each one. If anything here differs from the policy, the policy wins.

Report the vulnerability through GitHub's security advisory form of the core repository. Only you and the maintainers can see it. This is called coordinated disclosure: the project gets time to fix the problem before the details go public.

Never report a vulnerability in a public issue, a pull request, a forum post, or a chat channel. Details in public give attackers a head start on every home that has not updated yet.

The same goes when you find something as a contributor: in a pull request you review, in code you work on, or in a dependency. Report it privately first, and leave the public discussion for after the fix.

Policy: Reporting a vulnerability.

The policy asks you to describe a clear and realistic impact. A good report answers:

• What is affected: which part of Home Assistant, and which version
• What an attacker needs: network access, an account, or anything else
• How to reproduce it, step by step
• What the attacker gains

The project is mostly interested in reports from people who use Home Assistant and know it well, but all high quality reports are welcome.

If you know CVSS 3.1, add a score to your report as a vector string. The calculator helps. If you are unsure how to score it, or cannot, say so in your report, and the project looks into it.

Only add a score if you are familiar with CVSS. The policy recommends reading the specification and the scoring guide first: reports that use CVSS incorrectly are not accepted.

Policy: Severity scoring.

• The project does its best to respond within 7 days, and to keep you informed while the issue gets resolved. Home Assistant relies heavily on volunteers, so a reply can take longer than you would like.
• Give the project at least 90 days to release a fix, and do not make the vulnerability public without notifying the project first.
• For a valid vulnerability that meets the criteria below, the project publishes a GitHub security advisory.
• Published advisories are listed under past advisories on the security page. The past advisories reference groups them by kind, with the lesson of each.

Policy: Reporting a vulnerability.

Reports are only accepted against the latest stable, official version of Home Assistant, or a newer version that is in development or beta test. Find the latest version on the releases page.

Reports against forks of Home Assistant are not accepted.

Policy: Supported versions.

These types of reports are not accepted:

• Reports from automated tools or scanners
• Theoretical attacks without proof that they can be exploited
• Attacks that come from a third-party application or library (report those to its maintainers)
• Social engineering
• Attacks that need access to the host system that Home Assistant runs on
• Attacks that need physical access to a user's device, or a device or network that is already seriously compromised, like a man-in-the-middle
• Attacks that need the user to install other, malicious software, like a third-party integration (a custom integration), an app, or a plugin
• Attacks that users can only perform against their own setup
• Privilege escalation by logged-in users

That last one surprises people. The policy explains why: Home Assistant assumes every user is trusted and does not enforce user privileges. It assumes every logged-in user has the same access as an owner account. The user documentation explains this under user accounts.

Policy: Non-qualifying vulnerabilities.

The project publishes a GitHub security advisory, and requests a CVE through it, for a valid vulnerability that:

• Is in Home Assistant itself, not in a third-party library
• Was not already known to the project
• Was not already known to the public

A CVE is only requested when the severity is medium or higher.

Policy: Public disclosure & CVE assignment.

Home Assistant is an open source project and cannot offer bounties for security vulnerabilities. If you want, you are credited as the discoverer of the vulnerability.

Policy: Bounties.

If you plan to write about the security of Home Assistant, the policy asks you to get in touch at [email protected] first, so all claims can be checked.

• How Home Assistant handles trust: the trust model of the system.
• Past advisories: what went wrong before, and what to learn from it.
• Security policy: the official policy, and the full list of past advisories.