Security
How PocketOS protects your home, how to report a problem, and how long PocketOS receives security updates.
Report a security problem
If you find a security weakness in PocketOS, please tell us privately so it can be fixed before it is made public.
- Report it privatelyUse Report a vulnerability on GitHub. Only the PocketOS team can see it.
- Hear backWe acknowledge reports within 7 days and keep you updated until it’s resolved.
- Fix and creditFixes are delivered as signed updates. With your permission, we credit you in the release notes.
Please don’t test against devices or homes that aren’t yours.
Security updates
The PocketOS Device receives security updates until at least 31 December 2029. Updates are free and install over Wi-Fi.
- Updates are checked once a day, and install with a tap or automatically overnight.
- New versions are released gradually, so any problem can be stopped before it reaches every device.
- Release notes for every version are on What’s new.
How PocketOS protects your home
No shared passwordsEvery PocketOS creates its own setup Wi-Fi password the first time it starts. There are no default passwords.
Pairing on the deviceA phone can only change settings after entering the 6-digit code shown on PocketOS. Repeated wrong codes are locked out.
Signed updatesPocketOS only installs firmware signed by PocketOS. Downloads are checked before they are installed, and a version that fails to start is rolled back.
Local onlyPocketOS talks to your Home Assistant on your home network. There is no PocketOS account, cloud service or analytics.
Your token stays putThe Home Assistant token is stored only on PocketOS and is never shown again, even on the settings page.
Confirmed on the deviceErasing PocketOS or changing its Wi-Fi needs a press of the Boot button on PocketOS itself.
What to know
- Home Assistant access: Home Assistant doesn’t limit a user to particular devices. The PocketOS user you create can see and control every device in your Home Assistant, so keep PocketOS somewhere you’d keep a house key.
- On your Wi-Fi: the settings page uses your home network without encryption between your phone and PocketOS, like most home devices. Your Wi-Fi password protects it from outsiders.
- Lost, sold or given away: see below to cut off its access straight away.
If PocketOS is lost or stolen
- Remove its access to Home AssistantIn Home Assistant, sign in as the PocketOS user, open its profile, and under Security → Long-lived access tokens delete the PocketOS token. Or, as an administrator, go to Settings → People, open PocketOS and turn off Can log in.
- Optionally, change your Wi-Fi passwordPocketOS stores your Wi-Fi password so it can reconnect.
- If you find it againReset it from More → This PocketOS → Reset PocketOS, and set it up as new.
Selling or giving it away? Reset it first. That erases your Wi-Fi, Home Assistant connection and settings.