Authentication
Simple Budget uses JSON Web Token (JWT) based authentication with the HS256 signing algorithm. Access tokens are short-lived, expiring after 15 minutes, to minimise the window of exposure in the event of a token compromise. Refresh tokens are valid for 7 days and are stored securely in Redis with automatic expiration. When you log out, your refresh token is immediately invalidated.
Password Security
Your password is never stored in plain text. We use BCrypt, an industry-standard adaptive hashing algorithm, to hash passwords before storage. BCrypt incorporates a salt and is designed to be computationally expensive, making brute-force attacks impractical. Even if our database were compromised, your password would remain protected.
Data Encryption
In Transit
All communication between your browser and our servers is encrypted using TLS (Transport Layer Security). This ensures that your financial data, credentials, and any other information transmitted cannot be intercepted or read by third parties.
At Rest
Your data is stored in PostgreSQL databases with encryption at rest enabled. Database backups are also encrypted. Redis, used for caching and session management, is configured with append-only file persistence and runs in an isolated network environment.
Infrastructure
Our application runs in containerised environments using Docker, with each service (frontend, backend, database, cache) isolated in its own container on a private network. The backend API is built on .NET 10 with ASP.NET Core, benefiting from Microsoft’s security-hardened framework, built-in protection against common web vulnerabilities (CSRF, XSS, SQL injection), and regular security patches.
Access Controls
Simple Budget implements role-based access control for shared budgets. Budget owners can invite collaborators and control their permission levels. Each API request is authenticated and authorised to ensure users can only access data they own or have been explicitly granted permission to view.
Data Isolation
All database queries are scoped to the authenticated user’s account. Entity Framework Core’s parameterised queries prevent SQL injection attacks. Your financial data is never accessible to other users unless you explicitly share a budget with them.
Monitoring and Incident Response
We use structured logging via ILogger<T> across all services to monitor for unusual activity and potential security events. In the event of a security incident, we will notify affected users within 72 hours and take immediate action to contain and remediate the issue.
Vulnerability Disclosure Policy
If you discover a security vulnerability in Simple Budget, we encourage responsible disclosure and appreciate the security community’s efforts in keeping our users safe. This page is the policy referenced by our security.txt (RFC 9116).
How to report
Email security@simplebudget.au with a description of the issue, steps to reproduce (proof-of-concept, affected URL or endpoint), and the affected component (web app, API, marketing site, or mobile app). Please do not disclose the issue publicly until we have released a fix.
What you can expect
- Acknowledgement of your report within 3 business days.
- Triage and an initial remediation plan within 7 business days.
- Progress updates at least every 10 business days until the issue is resolved.
- Coordinated disclosure and credit (if you wish) once a fix is released.
Scope
In scope: the web app (app.simplebudget.au), the API (api.simplebudget.au), the marketing site (www.simplebudget.au), and our mobile apps. Out of scope: denial-of-service and volumetric testing, social engineering or phishing, automated scanner output without a demonstrated impact, missing best-practice hardening with no concrete exploit, and reports against third-party providers we use (report those to the respective vendor).
Safe harbour
We will not pursue legal action against researchers who act in good faith: avoiding privacy violations and service degradation, only accessing accounts they own or have permission to test, not exploiting an issue beyond what is needed to demonstrate it, and giving us reasonable time to remediate before any public disclosure. Activity consistent with this policy is considered authorised — if in doubt, ask us first.
Questions
For security-related inquiries, contact us at security@simplebudget.au. For general privacy questions, see our Privacy Policy.