Offline-first personal finance app. Primary goal: privacy by default.

• Device compromise: Lost/stolen phone, malware, physical access
• Data leakage: Accidental git commits, insecure file sharing
• App bugs: Import parsing errors, incorrect aggregations

• Network attacks (no backend)
• Account takeover (no authentication)

All data stored locally in SQLite:

• Transactions (amount, date, type, category, account, note)
• Categories and subcategories
• Accounts
• Asset goals

• ✗ Analytics or tracking
• ✗ Crash reporting
• ✗ Advertising IDs
• ✗ Cloud sync
• ✗ Server logs

Exports contain sensitive information:

• Store in encrypted/trusted locations only
• Verify git status before commits
• .gitignore blocks common export patterns

1. Use GitHub Security Advisories (preferred)
2. Or open an issue with no sensitive details and request private contact