Security

Reporting a vulnerability.

If you have found a security problem in Budy, we want to hear about it, and we will not come after you for telling us.

How to reach us

Email security@budyget.com. Include what you did, what happened, and enough detail for us to reproduce it. This is a monitored group address, not one person’s inbox.

The machine-readable version of this page is at /.well-known/security.txt.

What you can expect

  • Acknowledgement within two business days.
  • An assessment within five business days.
  • Updates until it is closed, and credit if you want it.

We do not run a bug bounty today and so cannot offer payment. If that changes it will be said here first.

Scope

In scope: the Budy mobile apps, api.budyget.com, admin.budyget.com, this website, and the infrastructure behind them.

Out of scope: denial of service, social engineering of our staff or our users, physical attacks, rate-limit or configuration findings with no demonstrated impact, output from an automated scanner with no working proof, and anything that requires the attacker to already hold the unlocked, rooted or jailbroken device of the account holder.

Testing in good faith

Use your own test account. Do not access, modify or destroy anybody else’s data — if a bug gives you access to it, stop and tell us rather than confirming how far it goes. Give us reasonable time to fix the problem before you publish. Do that, and we will treat your research as authorized and will not pursue or support a claim against you.

How Budy is built

  • Bank access is read-only. Budy cannot move money, and never asks for the ability to.
  • We never receive your bank username or password. Plaid handles the connection; we hold an access token, encrypted with a key we control, destroyed when you disconnect the bank or delete your account.
  • Encrypted in transit with TLS 1.2 or better, and encrypted at rest.
  • Receipt photos are read on your device and the image is never uploaded. To suggest a category we send the item text — not the picture — to match against our shared product list.
  • Our own access to production requires multi-factor authentication and least privilege. Administrative dashboards are scope-gated; access to an individual account through impersonation is read-only, time-limited, and audited.
  • Dependencies are scanned on every change, with fixed remediation deadlines for anything serious.
  • Security controls are enforced in code and infrastructure, and covered by automated tests that fail the build rather than a checklist somebody ticks.

Other contacts

See also our privacy policy and terms of service.