SUPERVISOR_TOKEN is the documented credential used by Home Assistant apps and the Home Assistant core to authenticate to Supervisor APIs. The Supervisor is the management layer that can control add-ons, system services, and other privileged operations, so this token carries far more value than an ordinary app secret.
In attacks, exposing SUPERVISOR_TOKEN can turn a local read bug into management-plane access: an attacker who steals it may issue Supervisor requests without needing to bypass authentication. That can lead to add-on control, configuration changes, or broader host-impacting actions depending on the deployment. Defenders should treat the token as sensitive, keep it out of logs and readable files, and limit file-read and command-injection paths that could expose environment variables. Least privilege and strict boundary handling are the main protections.