Home Assistant exposure needs separate checks for the API and local files
Home Assistant connects to lights, locks, cameras, alarms, energy systems, and other devices. Its web API is protected by an authentication system, but not every path served by the deployment has the same protection. The HTTP integration documentation warns that files in the www folder, served at /local/, are not protected by Home Assistant authentication. An exposure review that checks only the login page can miss that distinction.
A ZoomEye query for app="Home Assistant" returned 2,743,310 matches on 28 October 2026, using sub_type=all and a page size of one. The title query returned 2,742,279. The enormous count makes precise ownership more important, not less. Public smart-home interfaces can be intentional, but the operator still needs to know which device actions and files are reachable.
Map the public and trusted paths
Start with the hostname, remote-access method, reverse proxy, and Home Assistant Cloud or tunnel configuration. The HTTP documentation notes that Home Assistant Cloud requests arrive through a secure tunnel rather than a reverse proxy. If a custom reverse proxy is used, confirm that it forwards authentication headers only from trusted sources and that the Home Assistant endpoint cannot be reached directly around it.
The /local/ folder should be reviewed as a file publication area. List its contents and decide which files may be public. Images intended for dashboards, scripts, configuration exports, or documents with sensitive data may have been placed there for convenience. Move private content out of the public directory and verify the new access control from an unauthenticated browser.
API access needs its own inventory. Home Assistant's developer documentation describes authentication and access tokens. List long-lived tokens, the applications that hold them, the scopes or permissions they carry, and their owners. Rotate tokens before devices are decommissioned and after a suspected account compromise. A token created for a dashboard may have more authority than the person who requested it realizes.
Test device authority
Authentication does not prove that a token should be able to unlock a door or change an alarm state. Review entity access, dashboards, automations, and scripts for the identity that calls them. Test a limited user or token against a sensitive action and confirm the service rejects it. Check that device integrations use dedicated credentials where they support account separation.
Use the Home Assistant measurement only after confirming that a matching host belongs to the organization or a consenting user. Do not probe unknown smart-home systems. The query is a discovery index, not an invitation to test physical devices.
The action list is concrete: remove sensitive files from /local/, verify the API is behind the intended access layer, rotate unused tokens, and record who can control sensitive entities. Home Assistant's login page can be secure while a file path or overprivileged token weakens the deployment. Review both.
Top comments (0)