PIN Codes Visible in Activity Log

PIN Codes Visible in the Activity Log

Why are PIN codes visible in the device activity log?

When you view a code slot's device page in Home Assistant, the activity log shows state changes for all entities associated with that slot — including the PIN sensor and the text input used to set the PIN. These values are shown in plain text in the activity log.

This is expected behavior and is a limitation of how Home Assistant tracks entity state changes. HA's activity log records every state change for every entity, and there is no mechanism to selectively mask values in the log while keeping them functional.

Why is the PIN masked on the dashboard but visible in the activity log?

The slot card on your dashboard uses LCM's "masked with reveal" display mode, which intentionally hides the PIN behind dots until you click to reveal it. This is a frontend-only display feature.

The activity log, however, shows raw state change data from HA's core — it doesn't go through the slot card's masking logic. The entity state values are stored and displayed as-is.

Is this a security concern?

The device activity log is only accessible to Home Assistant administrators. Non-admin users cannot view device pages or activity logs. If you have concerns about who can see PINs:

• Ensure only trusted users have admin access to your HA instance
• Use HA's user management to restrict access appropriately
• Consider that anyone with admin access already has full control over your locks

Can this be changed?

There is currently no way to prevent HA from logging entity state changes in the activity log. Removing the device association for code slots would eliminate the per-slot activity view, but would also remove the ability to see all slot-related entities in one place — which is generally more useful than it is harmful.

If Home Assistant adds support for marking entity states as sensitive in the future, LCM will adopt that feature.