  
|
d9c184777e
|
[AI] Document intended global bank-sync credential access in sync-server (#9439)
* [AI] Document intended global bank-sync credential access in sync-server
Global bank-sync credentials are usable by any authenticated user by
design; add a note so this stops being reported as a vulnerability.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6
* [AI] Add SECURITY.md with threat model and align bank-sync comments
Document how to report vulnerabilities, the trusted-users threat model
for multi-user servers, and that shared global bank-sync credentials are
out of scope. Point the sync-server comments at it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6
* [AI] Clarify per-budget credential advice in SECURITY.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6
* [AI] Add release note for security policy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6
* [AI] Tighten security note wording on route scope and per-budget credentials
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6
---------
Co-authored-by: Claude <noreply@anthropic.com>
|
2026-11-05 18:27:25 +00:00 |
|