PlanabesOpen Planabes

Security

Security is part of the architecture.

Planabes uses modern transport protection, one-way password hashing, private sessions, encrypted provider credentials, and ledger-level data isolation.

Security controls

  • HTTPS is enforced for the production domain, with TLS certificates managed and renewed by Vercel.
  • Passwords are processed with scrypt and are not stored in readable form.
  • Session tokens are random, stored as hashes, and delivered in HTTP-only, SameSite cookies.
  • Every user workspace is scoped to a private ledger identifier in application queries.
  • Supported Interactive Brokers credentials are encrypted before database storage.
  • Statement imports use content hashes and transaction fingerprints to prevent duplicate records.

Responsible disclosure

Do not test against another user account, access data without permission, degrade service, or disclose sensitive findings publicly. Use the verified project-owner profile to request a private reporting channel before sharing affected URLs, reproducible steps, impact, or proof-of-concept material.

Supported scope

The supported public service is https://planabes.com. Third-party providers and social engineering are outside scope. Automated high-volume scanning requires prior authorization.

Operational transparency

A machine-readable disclosure policy is available at /.well-known/security.txt. The public owner profile is linked consistently so reports can verify project identity.