Home Assistant is the most security-sensitive thing in my home. It can unlock doors, open the garage and see the cameras. But when I asked myself “has anyone tried to get in?” or “who is using this long-lived token?”, I couldn’t answer.
What happened
- Failed logins only show up as a short notification or a line in the log, and they’re gone after a restart.
- Long-lived tokens have no “last used” date that’s easy to find, so I don’t know which ones I can safely revoke.
- Everyone at home has their own account and phone app, but I can’t see when and from where they’re used, or spot a login that doesn’t belong.
- I have no idea which servers my Home Assistant connects to, or which integration opens those connections.
What I expected
One place that answers these questions:
- recent logins and failed attempts, with IP, user and client
- tokens with when they were last used
- outbound connections, with the integration that made them
- simple warnings like “a user has no MFA” or “IP banning is off”
Why it bothers me
Home Assistant asks us to trust it with the whole house, but gives very little insight into what’s happening on the security side. You have to dig through logs or set up extra tools to get basic answers.
More
- Feature request with details: Built-in security visibility: access log, token usage and outbound connections per integration · home-assistant · Discussion #5453 · GitHub
- To check it can be done, I built a custom integration (with Claude Code) that does this as a sidebar panel: GitHub - schadom/ha-security-monitor: Home Assistant Security Monitor integration · GitHub. It works well for me, but this feels like something every installation should have out of the box.
