Home Assistant is the open-source hub that brings smart lights, thermostats, locks, cameras, energy meters and media players from different brands into one dashboard, and lets you automate them. It runs on a Raspberry Pi, a mini PC or a home server, talks to devices directly over your local network wherever it can, and keeps working when the internet or a vendor's cloud goes down.
It earns its place on this list because nothing else comes close on device support or community: thousands of integrations, a visual automation editor, voice control with a local assistant, energy tracking, and companion apps for iOS and Android. This repository, home-assistant/core, is the Python engine at the centre; the frontend, the operating system and the add-ons live in sibling repositories under the same organisation.
It is Apache-2.0, with about 91,700 stars and more than 6,000 contributors, at version 2026.10.4 when scanned, and is stewarded by the Open Home Foundation. A new release lands every month. Expect a learning curve: a simple setup takes an afternoon, while complex automations reward time with the docs.
- Repository: github.com/home-assistant/core
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 91.7K. Forks: 39K. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit fcdf331
Who it is for
Smart-home owners tired of a separate app for every brand, privacy-minded people who want devices controlled locally, and tinkerers with a Raspberry Pi or an always-on PC.
Getting started
1. Run it in Docker on Linux (set your time zone and config folder)
docker run -d --name homeassistant --privileged --restart=unless-stopped -e TZ=MY_TIME_ZONE -v /PATH_TO_YOUR_CONFIG:/config -v /run/dbus:/run/dbus:ro --network=host ghcr.io/home-assistant/home-assistant:stable2. Finish onboarding in your browser
http://localhost:8123The container install leaves out add-ons and one-click updates. For those, install Home Assistant OS on a Raspberry Pi or mini PC with the guide at home-assistant.io, or buy the ready-made Home Assistant Green hub.
Safety scan
We cloned home-assistant/core at commit fcdf331 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The 17 secret hits are not credentials. Fifteen are private-key header strings such as -----BEGIN PRIVATE KEY-----: five in the MQTT, WeatherKit and Harbor config flows, which check that a pasted key or certificate is in PEM format, and ten in tests. The other two are a fake GitHub token in the GitHub integration's test fixtures.
- The 3 pattern hits are tests: a Telegram API URL built in test_telegram_bot.py and two 4,000-character fixture lines in the Velbus tests. All 249 bare-IP URLs are in tests, standing in for cameras, media servers and routers on a home network.
- No known vulnerabilities across seven requirement and lock files covering about 1,300 packages. No committed binaries, and the only installer script is script/run-in-env.sh, a 31-line development helper with no sudo.
- 16 workflows, none using pull_request_target; 28 of 61 third-party actions are pinned to commits. CodeQL and Renovate are on, contributing guide and code of conduct present, and its OpenSSF Scorecard is 8.4 out of 10.
- The documented Docker command uses --privileged and --network=host so Home Assistant can find devices and reach Bluetooth over D-Bus. That is normal for a smart-home hub, but run it on a machine you dedicate to the job.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 17 candidates found and read; see the notes above. |
| Suspicious code | 3 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 16 workflows. None use pull_request_target. 33 of 61 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, www.home-assistant.io, www.googleapis.com, example.local. 249 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 0 advisories across 1,284 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. requirements.txt: 56 packages, 0 advisories; requirements_all.txt: 1,180 packages, 0 advisories; requirements_test.txt: 48 packages, 0 advisories; requirements_test_pre_commit.txt: 4 packages, 0 advisories; script/check_requirements/requirements.txt: 3 packages, 0 advisories; script/quality_scale_review/requirements.txt: 1 packages, 0 advisories; tests/e2e/pnpm-lock.yaml: 18 packages, 0 advisories. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file, contributing guide. Missing security policy. |
| OpenSSF Scorecard | 8.4 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (17, redacted)
Pattern hits (3)
| Where | Rule | Match |
|---|---|---|
| tests/components/telegram_bot/test_telegram_bot.py:190 | exfil-host (test/example) | f"'https://api.telegram.org/bot{api_key}/getMe'" |
| tests/components/velbus/conftest.py:467 | very-long-line | 4119 chars |
| tests/components/velbus/conftest.py:468 | very-long-line | 4123 chars |
URLs to bare IP addresses (249)
| Where | Rule | Match |
|---|---|---|
| tests/components/android_ip_webcam/conftest.py:16 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/conftest.py:22 | ip-literal-url | "http://1.1.1.1:8080/sensors.json", |
| tests/components/android_ip_webcam/test_config_flow.py:83 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/test_config_flow.py:96 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/test_config_flow.py:102 | ip-literal-url | "http://1.1.1.1:8080/sensors.json", |
| tests/components/android_ip_webcam/test_config_flow.py:129 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/test_config_flow.py:144 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/test_config_flow.py:150 | ip-literal-url | "http://1.1.1.1:8080/sensors.json", |
| tests/components/android_ip_webcam/test_init.py:43 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/android_ip_webcam/test_init.py:60 | ip-literal-url | "http://1.1.1.1:8080/status.json?show_avail=1", |
| tests/components/auth/test_indieauth.py:185 | ip-literal-url | "http://255.255.255.255/", |
| tests/components/auth/test_indieauth.py:191 | ip-literal-url | "http://11.0.0.0/", |
| tests/components/auth/test_indieauth.py:197 | ip-literal-url | "http://172.32.0.0/", |
| tests/components/auth/test_indieauth.py:203 | ip-literal-url | "http://192.167.0.0/", |
| tests/components/auth/test_indieauth.py:209 | ip-literal-url | "http://8.8.8.8:8123/", |
| tests/components/auth/test_indieauth.py:250 | ip-literal-url | pytest.param("http://100.64.1.1/", "http", "100.64.1.1", id="tailscale"), |
| tests/components/auth/test_indieauth.py:255 | ip-literal-url | "http://100.64.1.1/", "http", "100.64.1.1:80", id="http-default-port" |
| tests/components/auth/test_indieauth.py:264 | ip-literal-url | "http://100.64.1.1:80/", "http", "100.64.1.1", id="client-id-default-port" |
| tests/components/auth/test_indieauth.py:270 | ip-literal-url | "https://203.0.113.5:8443/", "https", "203.0.113.5:8443", id="port" |
| tests/components/auth/test_indieauth.py:287 | ip-literal-url | pytest.param("http://100.64.1.1/", "https", "100.64.1.1", id="scheme"), |
| tests/components/auth/test_indieauth.py:288 | ip-literal-url | pytest.param("http://203.0.113.5:8443/", "http", "203.0.113.5:9000", id="port"), |
| tests/components/auth/test_indieauth.py:290 | ip-literal-url | "http://100.64.1.1/", "http", "100.64.1.1:443", id="other-default-port" |
| tests/components/auth/test_indieauth.py:293 | ip-literal-url | "https://100.64.1.1/", "https", "100.64.1.1:80", id="https-port-80" |
| tests/components/auth/test_indieauth.py:295 | ip-literal-url | pytest.param("http://100.64.1.1/", "http", "100.64.1.1:abc", id="invalid-port"), |
| and 225 more | ||
Installer scripts (1)
- script/run-in-env.sh, 31 lines
By the numbers
| Stars | 91.7K |
|---|---|
| Forks | 39K |
| Contributors | 6,062 |
| Commits | 121.9K |
| Open issues | 2,453 |
| Open pull requests | 1,007 |
| Releases | 1,659 |
| Latest release | 2026.10.4 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 13 years |
| Last push | Oct 26, 2026 |
| Tracked files | 29,769 |
| Lines of code | 5.2M |
| Checkout size | 219 MB |
Lines by language: Python 4.1M, JSON 1M, YAML 75K, Markdown 4,649, TOML 1,112, Shell 84.
Questions
Is Home Assistant free?
Yes. Home Assistant is Apache-2.0 and free, with no account needed. Nabu Casa, the company that funds much of the work, sells an optional Home Assistant Cloud subscription for easy remote access and cloud voice; everything else works without it.
Does Home Assistant need the internet?
No. It runs locally, and many integrations talk to devices over your own network. Devices that only work through their maker's cloud still need the internet, and each integration's page says which kind it is.
What hardware should I run Home Assistant on?
A Raspberry Pi 4 or 5, an old mini PC, or a virtual machine on a home server all work. The project also sells Home Assistant Green, a small hub with the software preinstalled.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.