this is unacceptable HA is sending credentials up the line without opt-in, and their head dev refuses to acknowledge that this is a problem. this is the ssh xz issue all over again. someone is gonna drop code into HA to abuse this mechanism and its going to be a big ugly disaster. stop updating home assistant immediately