d9c184777e
* [AI] Document intended global bank-sync credential access in sync-server Global bank-sync credentials are usable by any authenticated user by design; add a note so this stops being reported as a vulnerability. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add SECURITY.md with threat model and align bank-sync comments Document how to report vulnerabilities, the trusted-users threat model for multi-user servers, and that shared global bank-sync credentials are out of scope. Point the sync-server comments at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Clarify per-budget credential advice in SECURITY.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add release note for security policy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Tighten security note wording on route scope and per-budget credentials Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 --------- Co-authored-by: Claude <noreply@anthropic.com>
2.0 KiB
Security Policy
Reporting a vulnerability
Please report vulnerabilities privately through GitHub: open the Security tab of this repository and choose Report a vulnerability. Do not open a public issue for security problems.
Include the affected version, your deployment setup (single-user or multi-user with OpenID), and steps to reproduce.
Supported versions
Only the latest release receives security fixes.
Threat model
Actual is a self-hosted personal finance app. Each sync server is run by its owner for themselves, or shared with people they trust, such as family members. Running Actual as a hosted or managed service for untrusted users is not a supported deployment.
In a multi-user (OpenID) setup, user roles (Basic / Admin) and budget ownership are there to organise who manages what. They are not a security boundary between users on the same server: everyone with an account is treated as trusted.
Out of scope
The following behaviour is intended and will not be treated as a vulnerability:
-
Shared bank-sync credentials. An admin can configure server-wide (global) credentials for bank-sync providers (GoCardless, Enable Banking, SimpleFIN, Pluggy.ai, Akahu and others). Any signed-in user on that server can use them. This feature will remain alongside per-budget credentials; a budget that has its own credentials uses those instead of the global ones.
For some providers (for example SimpleFIN and Akahu) the global credential is tied to the bank connections of the person who set it up. Every user on the server can then read the accounts and transactions behind it. Admins who do not want that should use per-budget credentials where the provider supports them, or not set up global credentials for that provider.
-
Issues that need a malicious user who already has an account on the server, where the impact is limited to data or features of that same server.
-
Issues that need control of the server host, its configuration, or its environment variables.