Home Assistant stops writing sign-in tokens and account passwords into its WebSocket debug log. With that specific debug logging enabled, incoming authentication messages and account-management commands previously appeared unchanged.
Josef Zweck adds redaction to both received-message logging paths, including nested data and batches of messages. Current passwords, replacement passwords and client secrets join the fields that are hidden.