mirror of
https://github.com/actualbudget/actual.git
synced 2026-11-09 10:45:04 -06:00
d9c184777e
* [AI] Document intended global bank-sync credential access in sync-server Global bank-sync credentials are usable by any authenticated user by design; add a note so this stops being reported as a vulnerability. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add SECURITY.md with threat model and align bank-sync comments Document how to report vulnerabilities, the trusted-users threat model for multi-user servers, and that shared global bank-sync credentials are out of scope. Point the sync-server comments at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Clarify per-budget credential advice in SECURITY.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add release note for security policy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Tighten security note wording on route scope and per-budget credentials Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 --------- Co-authored-by: Claude <noreply@anthropic.com>
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report vulnerabilities privately through GitHub: open the
|
|
[Security tab](https://github.com/actualbudget/actual/security) of this
|
|
repository and choose **Report a vulnerability**. Do not open a public issue
|
|
for security problems.
|
|
|
|
Include the affected version, your deployment setup (single-user or multi-user
|
|
with OpenID), and steps to reproduce.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release receives security fixes.
|
|
|
|
## Threat model
|
|
|
|
Actual is a self-hosted personal finance app. Each sync server is run by its
|
|
owner for themselves, or shared with people they trust, such as family members.
|
|
Running Actual as a hosted or managed service for untrusted users is not a
|
|
supported deployment.
|
|
|
|
In a multi-user (OpenID) setup, user roles (Basic / Admin) and budget
|
|
ownership are there to organise who manages what. They are **not** a security
|
|
boundary between users on the same server: everyone with an account is treated
|
|
as trusted.
|
|
|
|
## Out of scope
|
|
|
|
The following behaviour is intended and will not be treated as a
|
|
vulnerability:
|
|
|
|
- **Shared bank-sync credentials.** An admin can configure server-wide (global)
|
|
credentials for bank-sync providers (GoCardless, Enable Banking, SimpleFIN,
|
|
Pluggy.ai, Akahu and others). Any signed-in user on that server can use them.
|
|
This feature will remain alongside per-budget credentials; a budget that has
|
|
its own credentials uses those instead of the global ones.
|
|
|
|
For some providers (for example SimpleFIN and Akahu) the global credential is
|
|
tied to the bank connections of the person who set it up. Every user on the
|
|
server can then read the accounts and transactions behind it. Admins who do
|
|
not want that should use per-budget credentials where the provider supports
|
|
them, or not set up global credentials for that provider.
|
|
|
|
- Issues that need a malicious user who already has an account on the server,
|
|
where the impact is limited to data or features of that same server.
|
|
|
|
- Issues that need control of the server host, its configuration, or its
|
|
environment variables.
|