Authentication
Sign in with a passkey using your device screen lock or security key. Add and manage passkeys in Account security after verifying your email. Passwords remain available for initial account access and are stored as hashes; resetting a password does not remove registered passkeys. You can also review and revoke browser sessions. The account page reports when verification or recovery email delivery is unavailable.
Access control
The server checks current account access and permissions. Administrators have separate privileges and must have signed in recently before sensitive changes. Household access is limited to explicitly shared cash accounts and the joint plan; removing a member revokes that shared access.
Abuse protection
Login, registration, and demo endpoints are rate-limited per network address, and demo sessions are blocked from all write operations at the API layer.
External credentials
Plaid handles bank credential collection. BudgetR receives the tokens and account data needed to sync supported accounts.
Security contact
Report a security issue through the verified contact on the About page, also published in /.well-known/security.txt. Do not include passwords, recovery codes or customer financial records in a report.