Home Assistant makes its check for compromised secrets a deliberate choice. Supervisor stops enabling the Have I Been Pwned check by default, including on existing installations whose owners never changed this security setting.
The service receives the first five characters of a secret’s SHA-1 fingerprint, rather than the secret itself. The change responds to concerns that even this limited information derived from a secret was sent to a third party without an explicit choice.
An explicitly saved setting keeps its existing value. Owners who want the check can enable it with ha security options --pwned=true.