j_anglissj_angliss@fosstodon.org
Oct 16, 2026, 8:08 PM@Viss the number of folks that blindly install HACS stuff just compounds that. It'll be so easy to sneak in some add-in to abuse.
Replies
Jeffrey Bouterjbouter@fosstodon.orgOct 16, 2026, 9:19 PM@j_angliss @Viss don't applications installed through HACS have access to all secrets by default anyway? They run in the main python process with the same access as core. Meaning they have access to all secrets already. Basically, it doesn't take one line to abuse the HIBP functionality, just one line to ship the secrets elsewhere.
As far as I understand it, anyway.