mirror of
https://github.com/actualbudget/actual.git
synced 2026-11-09 10:45:04 -06:00
d9c184777e
* [AI] Document intended global bank-sync credential access in sync-server Global bank-sync credentials are usable by any authenticated user by design; add a note so this stops being reported as a vulnerability. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add SECURITY.md with threat model and align bank-sync comments Document how to report vulnerabilities, the trusted-users threat model for multi-user servers, and that shared global bank-sync credentials are out of scope. Point the sync-server comments at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Clarify per-budget credential advice in SECURITY.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Add release note for security policy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 * [AI] Tighten security note wording on route scope and per-budget credentials Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q8X9eQbJYThmFWQRnxw1Q6 --------- Co-authored-by: Claude <noreply@anthropic.com>
207 B
207 B
category, authors
| category | authors | |
|---|---|---|
| Maintenance |
|
Add a security policy explaining how to report vulnerabilities and that bank sync credentials set up by an admin are shared with all users on the server