When using the Hubitat Safety Monitor Picker tile to set the HSM to armed, disarmed, etc, I have noticed that the pop-up menu doesn’t go away after choosing what you want to do. It stays open indefinitely until you tap somewhere else on the screen to close it.
This creates an authentication loophole, because although I can PIN protect the tile, once the pop-up is open, it does not ask for the PIN again. If I arm the HSM using this tile, but I forget to close the pop-up, I can come back hours later, and the pop-up is still there, still allowing anyone to disarm it without re-entering the PIN.
I think a better behavior for this pop-up would be to automatically close immediately after choosing one of the menu items. This would force re-authentication even if the user forgets to close the pop-up. Alternately, a timeout period for auto-closing would also work, maybe even something configurable in the tile properties.
