tl;dr: A Home Assistant user discovered that the Supervisor automatically checks configured passwords against Have I Been Pwned without explicit opt-in, and filed an issue requesting it be opt-in. Maintainer Frenck initially dismissed the complaint—noting the check uses k-anonymity (only a 5-char SHA-1 prefix leaves the system)—before locking the thread, then later apologized and clarified it can be disabled via `ha security options --pwned=false`, promising to update the docs.