Home Assistant strengthens two boundaries that keep an installed app from affecting the wider system. Its operating-system agent rejects app security files that try to define another component’s protection rules, while Supervisor closes a route around its restrictions on privileged account commands.
An app’s security file could include an extra profile that replaced protections for another container or Supervisor itself. Stefan Agner makes the agent check every profile before loading or removing it. He reports that all 146 app profiles checked across the main stores and selected third-party stores remained compatible.
Supervisor also checks encoded request paths consistently before forwarding them. Previously, a differently encoded path could evade a blocked-route check and reach an account-management command with Supervisor’s identity. The correction preserves legitimate encoded paths while enforcing the existing restrictions.