A Home Assistant user objected that they had not explicitly authorized a feature checking app password settings against breach lists. A maintainer explained that warning display for an existing feature had recently been fixed and acknowledged inadequate notice. Supervisor code sends only the first five characters of a SHA-1 hash to Have I Been Pwned and compares the remainder locally. It does not transmit the complete password and can be disabled through the pwned=false security option, but this does not settle the prior-consent issue or mean the default has changed.