This repository is intended to contain only sanitized Home Assistant configuration and supporting tools.

Do not commit or upload:

• Home Assistant backups or extracted backup directories;
• .storage, .cloud, recorder databases, logs, or secrets.yaml;
• TaHoma/Overkiz usernames, passwords, hub identifiers, IP addresses, tokens, cookies, or diagnostic exports;
• private keys, environment files, or archives that may contain any of the above.

The .gitignore and CI checks reduce risk, but they are not a substitute for reviewing every staged change before committing.

1. Do not merely delete it in a later commit; Git history still contains it.
2. Revoke or rotate the credential immediately in the relevant service.
3. Remove it from the repository history before publishing or sharing again.
4. Review Home Assistant and TaHoma account activity and active sessions.

Treat any Home Assistant backup as sensitive even when its filename looks harmless. Backups may include credentials, device identifiers, network information, authentication data, and location history.

Report security issues privately to the repository owner. Do not open a public issue containing credentials, private configuration, device identifiers, or reproduction data copied from a real installation.