Home Assistant stops configuration errors from echoing passwords, API keys, access tokens and authentication PINs into logs. A rejected credential is replaced with a redaction marker while the setting’s location and the reason it failed remain visible.
Franck Nijhof applies the protection across hundreds of configuration and setup forms, including 470 password fields and 171 API-key fields. Settings that merely identify something, such as a hardware pin number, stay readable so the error remains useful.
The protection uses the Secret marker in Probatio, the validation engine introduced in Home Assistant 2026.9. Custom integration authors can use that marker for their own credentials; the new developer post explains that existing imports remain compatible.