# diagnostics.redaction.used

> **Generated from `RuleDefinition` metadata.** Edit only the section below the
> "HANDWRITTEN BELOW" marker; everything above is regenerated by
> `hasscheck docs-render`.

## Summary

diagnostics.py uses redaction

## Why

Home Assistant diagnostics expose integration state for troubleshooting. Without redaction, sensitive fields (API keys, tokens, passwords, coordinates) can be leaked when users share diagnostic data. Use async_redact_data from homeassistant.components.diagnostics or a local redaction helper to strip sensitive keys before returning. Note: this rule uses AST static inspection and cannot detect redaction performed in a base class, mixin, or via dynamic dispatch — those cases may produce a false WARN. A WARN does NOT guarantee a bug; treat it as a prompt for MANUAL_REVIEW of the diagnostics output.

## Status behavior

| Field | Value |
|---|---|
| Category | diagnostics_repairs |
| Severity | recommended |
| Overridable | True |
| Version | 1.0.0 |

## Source

- https://developers.home-assistant.io/docs/core/integration/diagnostics/
- `source_checked_at`: 2026-05-01

<!-- HANDWRITTEN BELOW THIS LINE -->

## Examples

### Passing

```python
from homeassistant.components.diagnostics import async_redact_data

TO_REDACT = ["api_key", "token"]

async def async_get_config_entry_diagnostics(hass, entry):
    return async_redact_data(dict(entry.data), TO_REDACT)
```

### Failing / warning

```python
async def async_get_config_entry_diagnostics(hass, entry):
    # Returns raw entry data — likely exposes secrets
    return dict(entry.data)
```

HassCheck reports WARN because `entry.data` is returned without redaction.
