Security. What Bufin Can and Cannot Access
Last updated 2026-08-18
We take the security of a budgeting app seriously, and we welcome the help of security researchers. This page explains how Bufin protects your data and, most importantly, how to report a vulnerability responsibly.
1. How we protect your data
Bufin is built privacy-first: with Google sign-in your financial data lives in your own cloud and never touches our servers, so we can't read it even if we wanted to. Beyond that: all traffic uses TLS; sign-in sessions are short-lived signed tokens; our API enforces rate limits and Cloudflare Turnstile to block automated abuse; secrets live in Cloudflare's encrypted store, never in code; two-factor authentication is available in Settings; and an optional end-to-end encryption mode ("Ghost Mode") encrypts transaction descriptions with a passphrase only your browser knows.
1a. Exactly what Bufin can and cannot access
What Bufin CANNOT access: your Google Drive or OneDrive files outside its own hidden application folder. Bufin requests only the app-folder scope (Google: drive.appdata), which is a private area created for this app; it grants no ability to list, read or write your documents, photos or anything else, and no amount of server-side code could reach them because the permission was never granted. Nor can it access your bank: Bufin has no open-banking connection and never asks for banking credentials.
What Bufin CAN access, and when: the files it wrote in that app folder, in your browser, while you have the app open and a valid access token. Token handling: the short-lived access token stays in your browser; a long-lived Google refresh token is also held by your browser and exchanged through our Worker only to mint a new access token, so our server stores neither. Revoke Bufin at myaccount.google.com/permissions and that access ends immediately.
What our server holds (Cloudflare D1, and it is a short list): your account record, the id, email, display name and picture from sign-in, your two-factor setting, your roadmap proposals and votes, bug reports you submit, salted one-way hashes of IP addresses for rate limiting, and aggregate page/click counters. Not your transactions, budgets, balances, merchant names or account numbers. There is no table for them.
The exceptions, stated plainly. (i) Households: a shared budget has to be readable by more than one person, so household transactions, budgets, bills and envelopes are stored on our servers. Your personal budget is separate and stays in your own storage. (ii) View-only share links: creating one puts a snapshot on our servers so the recipient can open it; it expires, and revoking it deletes the snapshot. (iii) Support: if you paste figures into a bug report or an email, we can obviously read what you sent us. Everything in this paragraph happens only because you chose to do it.
No-account mode: with no sign-in, your budget is written to your browser's local storage and never leaves the device. Nothing to intercept, and nothing on our side at all. The security trade-off runs the other way, though, and it is real: browser storage is not encrypted at rest by us, anyone with access to your unlocked device and browser profile can read it, clearing site data destroys it, and there is no backup anywhere. Ghost Mode (passphrase encryption of descriptions) still applies, and exports still work; use one of them.
Encryption: everything in transit uses TLS. At rest, your budget is protected by whatever your cloud provider applies to your files. Bufin does not add its own layer over Drive or OneDrive, and says so rather than implying a stronger guarantee than exists. Ghost Mode is the exception: with it on, transaction descriptions are encrypted in your browser with a passphrase we never receive, so even the file in your Drive does not contain readable text.
Deleting everything: Settings → Data deletes your account and its server-side rows (households you own, share links, votes, bug reports) and, on request, we confirm it. Your Drive or OneDrive files are yours: the app can delete them for you, and if you would rather do it yourself, revoke access and delete the app-data folder from your own account.
2. How to report a vulnerability
Email [email protected] with the subject line starting "SECURITY:". Please include enough detail to reproduce the issue: the affected URL or feature, the steps, and the impact, plus any proof-of-concept. Our machine-readable contact details are also published at /.well-known/security.txt. We aim to acknowledge your report within a few days and to keep you updated as we work on a fix.
3. Safe-harbour: research done in good faith
If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we'll treat it as authorized. To stay in scope, you must: only interact with accounts you own or have explicit permission to test; never access, modify, delete, or exfiltrate other people's data; avoid privacy violations, data destruction, and any degradation of the service (no denial-of-service or spam); stop as soon as you've demonstrated a vulnerability; and give us a reasonable amount of time to fix it before disclosing publicly.
4. Scope
In scope: bufin.app, the Bufin web app, and our API. Out of scope (please report these to the provider instead): Google, Microsoft and Cloudflare infrastructure (Bufin has no payment processor, nothing is sold); anything requiring physical access, social engineering of staff or users, or a lost/stolen device; and volumetric denial-of-service testing. Reports that are only theoretical, or that boil down to missing "best-practice" headers with no demonstrated impact, may be acknowledged but not treated as vulnerabilities.
5. Our commitment to you
Bufin is a small independent project, so we don't run a paid bug-bounty program, but we're genuinely grateful. With your permission, we're happy to credit you publicly once a fix is shipped. We won't disclose your identity without your consent.
6. Contact
Security reports: [email protected] · /.well-known/security.txt. For non-security issues, use the in-app bug report instead.