Loading report…
← nittim
← nittimshared scan
home-assistant/core ↗ · f6c9b6f · Aug 21, 2026, 10:38 PM
Hard evidence: 2 issues need attention now.
Free scan · deterministic evidence only
2 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
500 of 27128 files scanned (1%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
What this means
Two scanners read 500 of 27128 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 2 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvePyPI cryptography2 in 1 version
48.0.1 — GHSA-g6cj-pr64-35w5, GHSA-jwv3-5hgf-82ww
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing — HIGH
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building — HIGH
Worth knowing, not blocking
test fixtureGeneric hardcoded secret6 in 4 files
tests/components/http/test_auth.py:48
:48 — API_PASSWO…ord" — non-production path
tests/components/matrix/test_login.py:44, :55, :69
:44 — passwo…ord", — non-production path
:55 — passwo…ord", — non-production path
:69 — passwo…ord", — non-production path
tests/helpers/test_config_entry_oauth2_flow.py:30
:30 — REFRESH_TOKEN …ken" — non-production path
tests/scripts/test_auth.py:90
:90 — hass, provider, Mock(username="test-user", passwo…ass") — non-production path
test fixtureJSON Web Token3 in 3 files
tests/components/elmax/fixtures/cloud/login.json:2
:2 — "token": "JWT eyJhbG…ICv0", — non-production path
tests/components/elmax/fixtures/direct/login.json:2
:2 — "token": "JWT eyJhbG…50cA" — non-production path
tests/components/elmax/fixtures/login.json:2
:2 — "token": "JWT eyJhbG…ICv0", — non-production path
moderate cvePyPI cryptography@48.0.1GHSA-m2h6-j472-rp4c
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees — MODERATE
AI audit · home-assistant/core · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 500 of 27128 files (highest-priority subset) · home-assistant/core
Dependency manifests: 1 package root found, 1 scanned; 4 Python manifests read.
README badge
[](https://nittim.com/library/home-assistant/core)