Security

A local-first model with clearly stated limits.

OpenFinance avoids bank connections and processes imported CSV data on the user's device. Local processing reduces exposure, but it does not make every device, browser, downloaded file, or software build automatically secure.

Security model

• No bank credentials are requested.
• No OpenFinance account is required for the public application.
• CSV contents are parsed on the device and persisted locally in IndexedDB.
• Android application backup is disabled for OpenFinance data.
• The source code is publicly reviewable under the MIT license.

User responsibilities

• Use a supported, updated browser and operating system.
• Protect the device account and disk, especially on shared computers.
• Do not upload CSV files received from untrusted sources.
• Review parsed amounts and categories before relying on a report.
• Keep independent copies of source statements; OpenFinance is not a backup service.

Reporting a vulnerability

Do not publish exploitable details in a public issue. Use GitHub's private vulnerability-reporting feature when available, or contact the repository owner through the contact information on jeffreymacy.com. Include the affected version, reproduction steps, impact, and a safe proof of concept. Never include real financial data.

Financial accuracy disclaimer

OpenFinance is an organizational and visualization tool, not accounting, tax, legal, investment, or financial advice. CSV formats and categorization rules can be incomplete or incorrect. Verify all calculations and exports against original records and consult a qualified professional for decisions where accuracy has legal, tax, or financial consequences.