Security and network

Credentials

After pairing, the device receives a random revocable 256-bit credential. HA stores only its hash; Android stores it privately with backup disabled. Rotation or revocation ends existing sessions. Provider keys stay in private HA storage and are removed from logs and diagnostics.

TLS

HTTPS is mandatory. Modern devices validate system CAs and host names. Old Android versions use the release-maintained Conscrypt/CA stack. After manual confirmation, the SHA-256 SPKI public-key pin is stored, not the short-lived leaf certificate. A real key change pauses the connection and displays the new certificate fingerprint and public-key pin for confirmation.

Legacy exception

The host override solves routing/DNS problems without changing URL or TLS name. The insecure option disables trust-chain and host-name verification and is intended only for isolated legacy devices. It is not an automatic fallback and must be deliberately enabled. Device credential and messages remain encrypted as long as TLS can technically be established.

Backpressure and offline

Control and stream queues are bounded. Obsolete sensor samples and intermediate states may be coalesced; command ACKs and revisions may not. Old notifications or actions are not replayed after offline periods. The app marks HA-dependent controls unavailable and keeps rendering the last acknowledged configuration.