Built-in security visibility: access log, token usage and outbound connections per integration

[schadom]

Describe your core improvement

Home Assistant should give administrators a built-in view of security-relevant activity:

• Access log: failed logins, IP bans and token use (who, from which IP, when), kept over time.
• Token overview: all refresh and long-lived tokens across users, with last use and last IP, and long-lived tokens unused for a long time flagged.
• Outbound connections per integration: which internet hosts Home Assistant contacts, and which integration made each request.
• Security checks in Repairs: for example admin users without MFA, IP banning disabled, or an external URL without HTTPS.

Current limitations

• A failed login produces a log warning and a persistent notification. There’s no history and no dedicated event to automate on.
• Token usage (last used time and IP) is stored, but there’s no admin-wide overview.
• There’s no way to see which integration talks to which host. A custom integration can only find out by wrapping private aiohttp internals and inspecting the call stack, and traffic outside aiohttp can’t be attributed at all.

Technical benefits

• Core already has helpers to identify the calling integration (used for its “Detected that custom integration … “ warnings), so attribution could be done reliably at the source, without hooks.
• A dedicated event for failed logins and bans would let users build notifications with normal automations.
• It supports local control and privacy: users can see what leaves their home and which integration sends it.
• One maintained implementation instead of custom integrations that depend on private APIs and can break with any update.

Additional context

I built a custom integration as a working prototype: https://github.com/schadom/ha-security-monitor (screenshots in the README). It works, but it depends on private APIs: auth internals, the ban logger’s message format and ClientSession._request. That’s why I think the foundation belongs in core. The prototype was written with Claude Code.