-
Notifications
You must be signed in to change notification settings - Fork 0
Security and Privacy
BackupCheckup monitors and verifies backups but never changes them. It does not call a restore endpoint or write to the production Home Assistant configuration.
- downloads only through Home Assistant's native backup interfaces,
- uses a private temporary workspace,
- applies fixed download, expanded-size, metadata, member-count, timeout, and free-space limits,
- rejects absolute paths, traversal, unsafe links, device objects, and other unsafe archive entries,
- completely reads every regular file,
- extracts only what is required for optional database verification,
- cleans temporary data after success, failure, or cancellation,
- creates a Repair if cleanup cannot be confirmed.
Only small evidence such as status, time, counts, SHA-256, and stable error codes is retained.
BackupCheckup uses only a password supplied by Home Assistant for the selected backup. It does not request a separate password, log it, or persist it. If no matching password is available, verification ends with password_required.
Backup names, native IDs, paths, and detailed failure lists are not published in entity attributes by default. Expose private backup metadata is an explicit expert option and should be enabled only when an automation truly needs those values.
Diagnostics and activity records use fixed action, outcome, and error codes plus counts. They exclude or anonymize:
- backup names and raw IDs,
- backup contents,
- passwords and tokens,
- paths, hostnames, and IP addresses,
- selected notification targets,
- specific external-dependency names.
Targets are limited to enabled notify entities created by the Home Assistant Companion App. Diagnostics contain only the target count. Messages contain understandable states and recommendations, not backup contents or credentials.
Preparedness stores only fixed enum states and timestamps. It cannot accept notes, passwords, paths, accounts, or contact data. Storage targets and contents are reduced to generic categories and anonymous references.
The optional runner does not mount production configuration. The verified archive is transferred over pinned TLS with bearer authentication. Restored Home Assistant runs in a separate network namespace as an unprivileged user without capabilities, Supervisor credentials, or privilege escalation.
The controller needs NET_ADMIN and SYS_ADMIN only for namespace creation. Those capabilities are removed before restored Home Assistant starts. The runner has no host network, Docker socket, or Home Assistant API access.
Starting with 3.0.11, the temporary Home Assistant log is created with ownership and mode restricted to the unprivileged sandbox account. This allows the child process to write its startup log without widening access to other users.
A valid archive may still depend on unavailable external systems. A successful runtime start does not prove that MQTT, an external database, cloud accounts, radio hardware, or replacement hardware will work after a disaster. BackupCheckup combines technical evidence with preparedness guidance, but a full restore on separate hardware remains the strongest test.
Never attach a backup or unredacted configuration to a public issue. Use the repository Security Policy and provide only version information, reproducible steps, sanitized diagnostics, and stable error codes.