HAB never asks for a password, token or API key. Sign-ins stay in Home Assistant. The app keeps only its Home Assistant login token in the browser's storage on the tablet.

If you find a security problem, please do not open a public issue. Use GitHub's private vulnerability reporting for this repository (Security tab, Report a vulnerability).

Things worth reporting: a way to change settings without being an administrator, a way to read data from Home Assistant that the signed-in user should not see, anything that sends data to a place the owner did not choose.