Security

FlyBudget handles something personal: your money. We've tried to be as careful as we possibly can with it, and this page explains, in plain language, everything we do to keep your data and your bank connections safe.

Found a security problem? Tell us privately

If you think you've found a security issue, no matter how small or unlikely, please report it privately on GitHub rather than opening a public issue. Only the maintainers can see private reports, which gives us time to fix the problem before anyone can take advantage of it. We aim to respond within 7 days, and we'll credit you when the fix ships (unless you'd rather stay anonymous). Our full policy is in SECURITY.md.

The short version

• Your data stays on your computer. No FlyBudget account, no online FlyBudget service, no tracking, and no crash reports.
• Your bank credentials are encrypted in the desktop app, with a key protected by your operating system.
• You log in on Plaid's, SimpleFIN's, or your bank's own website, never inside FlyBudget.
• Every release comes with a verifiable build signature, so you can confirm the download is genuinely ours.
• Every change is automatically tested and scanned for security problems.

Our security ratings

We don't just say FlyBudget is secure. We let independent tools check it, publicly.

Check	Result (September 2026)
OpenSSF Scorecard	8.6 / 10
Known vulnerabilities in dependencies (Dependabot)	0 open
Security issues found in our code (CodeQL, extended security rules)	0 open
Leaked secrets in the repository (GitHub secret scanning, full history)	0 found

The live score is always here:

The OpenSSF Scorecard is an independent rating from the Open Source Security Foundation. FlyBudget scores a perfect 10 on 12 of its checks, including signed releases, pinned dependencies, least-privilege automation, dependency updates, fuzz testing, and having no known vulnerabilities. The points we don't have yet mostly reflect how new FlyBudget is. For example, Scorecard wants a second person to review every change, which will come naturally as more contributors join the project.

Your data stays yours

FlyBudget is local-first. Your budget lives in a database file on your own computer, and the app talks to its own small built-in server that only listens on your machine (127.0.0.1). There is no FlyBudget cloud to be breached, no account to be phished, and no analytics.

The only time FlyBudget talks to the internet is when bank sync connects to Plaid, SimpleFIN or Enable Banking on your behalf, always over encrypted HTTPS.

If you host FlyBudget yourself

You can also run FlyBudget on your own server with Docker and open it in a browser. Then your data lives on your server instead of your computer, and a few extra protections apply:

• A password protects everything. You create it on the first visit, using a one-time setup code that only appears in the server's log, so nobody else can claim your server before you do. It's stored as a scrypt hash, never in plain text, and after 10 wrong attempts logins are blocked for 15 minutes.
• Login sessions are hard to steal. Each one is a random 256-bit token kept in a cookie that scripts can't read and other websites can't send, stored on the server only as a hash, and expiring after 30 days. Changing your password signs out every other device.
• Bank credentials are always encrypted. The server refuses to start without an encryption key, which you keep outside the database as a Docker secret.
• The container is locked down. It runs as an unprivileged user, and the example setup makes its filesystem read-only and drops all Linux privileges.
• Images are verifiable. They're built by GitHub from the public source, with a signed build attestation (just like the desktop installer) and a software bill of materials, and they're scanned for known vulnerabilities every week.
• HTTPS stays HTTPS. Behind an HTTPS proxy, FlyBudget tells browsers never to fall back to plain HTTP for your address.

Use HTTPS (through a reverse proxy like Caddy) before making your server reachable from the internet. The self-hosting guide shows how.

Your bank connections

Plaid

• You log in on Plaid's own page, in your web browser. When you connect a bank, FlyBudget opens Plaid's secure hosted page in your browser, the same browser you already trust with your bank, where your password manager works and banks that use OAuth (like Chase and Wells Fargo) are supported. Your bank password never passes through FlyBudget.
• Tokens never reach the app's screen. Plaid gives the built-in server a token for reading your transactions. It's exchanged and stored on the server side only, and the interface never sees it.
• Tokens are encrypted before they're saved (see below).
• Disconnecting really disconnects. When you remove a bank, FlyBudget tells Plaid to revoke access, not just forget it locally. We tested this against Plaid: after disconnecting, the old token is rejected. If Plaid can't be reached at that moment, FlyBudget keeps the connection and asks you to try again, rather than leaving a live token behind.
• You use your own Plaid keys, so there's no FlyBudget service in the middle: it's just you, Plaid, and your bank.

SimpleFIN

• Your SimpleFIN access is encrypted before it's saved.
• Protected against tricks. A SimpleFIN setup token is really a web address. FlyBudget only follows secure public https addresses, checks the real destination at the moment it connects, and re-checks every redirect, so a malicious token can't point FlyBudget at your home network or other private systems.
• Bank data is double-checked. Everything SimpleFIN sends is validated before it's saved, and amounts are converted to exact cents, so malformed data can't corrupt your budget.
• Disconnecting: SimpleFIN doesn't offer a way for apps to revoke access, so FlyBudget deletes its copy and reminds you to also remove the app in your SimpleFIN Bridge account.

Enable Banking

• You log in on your bank's own page, in your web browser, and confirm there what FlyBudget may read: your accounts, balances and transactions, nothing else. FlyBudget can't make payments.
• You use your own Enable Banking application. Its private key stays on the FlyBudget server, encrypted, signs every request, and is never shown to the app's page or included in backups. FlyBudget checks it with Enable Banking before saving it.
• The bank's redirect proves itself. When your bank sends you back, the request carries no login or app token (browsers don't send those from another website), so FlyBudget accepts it only with the random, single-use code it made for that login, for 30 minutes. That one address is the only part of FlyBudget that works without them, and it does nothing else.
• The desktop app's relay page only goes to your computer. Enable Banking needs an https redirect address, so the desktop app uses a static page on flybudget.org that forwards the bank's one-time code to 127.0.0.1 on your computer. It can't send anyone anywhere else, keeps nothing, and the code is useless without your private key.
• Bank data is double-checked, like SimpleFIN's: validated before it's saved, amounts converted to exact cents, and text cleaned of control characters.
• Disconnecting really disconnects. FlyBudget ends the session at Enable Banking before forgetting it; if Enable Banking can't be reached, the connection is kept so you can try again. (The one exception is a bank you connected twice: ending one session would also end the other's, so that one is only forgotten and its access runs out on its own date.)

Encryption

Your most sensitive secrets (your Plaid keys, your Plaid access tokens, your SimpleFIN access, and your Enable Banking key and sessions) are encrypted with AES-256-GCM, the same standard used by banks and governments. The encryption key itself is protected by your operating system (Windows DPAPI, the macOS Keychain, or the Linux secret service), so it only works for your user account on your computer. This applies to the FlyBudget desktop app; on a system without OS secure storage (for example some Linux setups without a keyring), credentials are stored without this extra layer.

That means a copied or backed-up database file does not give anyone access to your bank accounts.

Your budget and transactions themselves are protected by your operating system account, the same way Actual Budget, Firefly III, and most other local finance apps work. For the best protection, turn on full-disk encryption (see below).

The app itself

The built-in server only answers FlyBudget. Other websites you have open can't read your data or quietly make changes, even though the server is running on your computer. In the desktop app, every request also needs a secret that's created fresh each time you open FlyBudget, so other programs and other users on the same computer can't get in either.

A strict Content Security Policy. In the desktop app, the page is only allowed to run FlyBudget's own code and only allowed to talk to its own server. No third-party scripts, fonts, trackers, or frames are loaded at all, even the fonts are bundled with the app.

A locked-down desktop app. The FlyBudget window:

• runs in a sandbox with no direct access to your computer,
• can't be steered to other websites,
• refuses every request for your camera, microphone, location, or notifications,
• only opens secure https links, in your normal browser,
• disables developer tools in releases, and
• refuses to start if its own files have been tampered with.

Careful with your files. Exported spreadsheets are protected against "formula injection," where a booby-trapped merchant name could run something when you open the file in Excel. Error messages don't reveal internal details like file paths.

Verifying your download

Every release is built by GitHub from the public source code and signed with Sigstore, with SLSA build provenance that records exactly how and where it was built. You can check that the file you downloaded is genuine with the GitHub CLI (use the name of the file you downloaded):

gh attestation verify FlyBudget-Windows-Setup.exe -R dtymoszenko/FlyBudget

If the file was modified in any way, even by a single byte, verification fails. Only download FlyBudget from our download page or our GitHub Releases page. Each release also lists every file's SHA-256 in SHA256SUMS.txt.

The app isn't signed with a paid Microsoft certificate or notarized by Apple yet, so Windows may show an "unknown publisher" warning and macOS asks you to allow it in Privacy & Security the first time you open it (the install guide shows how). Code signing is next on our list; until then, the command above is the way to confirm your download is genuine.

How we build FlyBudget

Security isn't a one-time checklist, so these run automatically, all the time:

• Automated tests on every pull request, including property-based tests that check each rule against many randomly generated inputs, covering the money math, the bank-data handling, and the security protections.
• CodeQL scans every pull request and every update to the main branch with GitHub's extended security rules.
• Dependabot watches every dependency for known vulnerabilities and opens fixes automatically.
• Supply-chain protection: Dependabot waits 7 days before proposing a brand-new package version (hijacked releases are usually caught within days), install scripts from packages are blocked entirely, and the registry signature of every package the app uses is verified.
• Pinned automation: every GitHub Action is pinned to an exact version, with the minimum permissions it needs.
• Protected main branch: pull requests can't be merged until the full test suite passes.
• Secret scanning with push protection blocks accidental commits of keys or passwords.

What you can do

FlyBudget can protect you from a lot, but not from someone who already controls your computer. A few simple habits make a big difference:

• Turn on full-disk encryption: BitLocker on Windows, FileVault on Mac.
• Use a strong password for your computer login.
• Treat exports and backups as private. They contain your full financial history (but never your bank credentials).
• Download FlyBudget only from our GitHub Releases page, and verify it with the command above.
• Disconnect banks you no longer use.

Being honest about what we can't do

No software can promise to be perfectly secure, and we'd rather be upfront than overpromise:

• Anyone who can log in to your computer as you can see your budget. Full-disk encryption and a strong login password are your best protection.
• FlyBudget is a young project, built by one developer today and growing. As more contributors join, we look forward to adding more reviewers and, down the road, independent security audits.
• Plaid, SimpleFIN and Enable Banking are separate services with their own security. Issues with them should be reported to them directly.

Report a vulnerability

If you find anything that could put FlyBudget users at risk, please report it privately on GitHub. Include what you found, how to reproduce it, and why you think it matters. Please don't post it publicly until we've had a chance to fix it.

Thank you for helping keep FlyBudget and everyone who uses it safe. 💙