Most security pages are a list of reassuring adjectives. This one is a list of specific things you can check.
Signing in
Passkeys (WebAuthn). You can sign in with a passkey — Face ID, Touch ID, Windows Hello or a hardware key. Passkeys are phishing-resistant: the credential is bound to spendly.app and cannot be replayed on a lookalike domain, which is the failure mode that defeats passwords and one-time codes alike.
Two-factor authentication (TOTP). Standard authenticator-app 2FA, with single-use backup codes. Both the TOTP secret and the backup codes are stored encrypted at the application layer, not in plain text. Backup codes are individually hashed, and a used code cannot be replayed.
Password hashing. Passwords are hashed with bcrypt. We never store or transmit them in a recoverable form, and we cannot tell you your password because we don’t know it.
Social sign-in. Google and Apple are supported. If you use them, that provider handles authentication and we never see a password at all.
Sessions
Your session cookie is:
- httpOnly — JavaScript on the page cannot read it, so a script injection cannot exfiltrate your session
- Secure — transmitted over HTTPS only
- SameSite=Strict — not sent on cross-site requests, which blocks the standard CSRF path
Sessions can be revoked server-side. Signing out invalidates the token rather than just clearing it locally, and deleting your account invalidates every outstanding session immediately.
Rate limiting and lockouts
Brute-force attempts are throttled on three axes at once:
| Limit | Threshold | Window |
|---|---|---|
| Failed attempts per account, per IP | 5 | 15 minutes |
| Failed attempts per IP, all accounts | 20 | 15 minutes |
| Failed attempts per account, all IPs | 25 | 15 minutes |
Lockout lasts 15 minutes. The per-IP cap stops one source spraying many accounts; the per-account cap stops a distributed attempt against one account. Two-factor failures feed the same system, and the lockout is checked before verification, so a correct password does not reset the counter and hand an attacker an unlimited guessing oracle.
Your data
Export. You can export your accounts, budgets, categories, investments and transactions to CSV at any time, from inside the app. You are not locked in.
Deletion. You can delete your account from Settings. This immediately revokes every session and removes your access.
Transport. All traffic is served over HTTPS.
Scope
Spendly is a budgeting tool, not a bank. It holds no money and moves no money, so there is nothing in your account that can be spent or transferred by someone who gets into it.
Encryption. Your two-factor secrets and backup codes are encrypted at the application layer. Everything else is protected by access controls, HTTPS in transit, and encrypted storage and backups.
Deletion. Deleting your account revokes every session immediately and removes your access. Records are then purged on our normal retention cycle; if you need confirmed immediate erasure, email us and we’ll do it and confirm.
Reporting a vulnerability
Email [email protected], which is also the contact in our security.txt.
Please include enough detail to reproduce the issue. We’ll acknowledge your report and keep you updated on the fix. We won’t pursue legal action against anyone who reports a genuine vulnerability in good faith and gives us a reasonable window before disclosing it publicly.
Practical advice
The most likely way an account gets compromised is not a flaw in Spendly:
- Use a passkey if your device supports it. It removes the phishing risk entirely.
- If you use a password, make it unique. Credential-stuffing with passwords leaked from other sites is the single most common attack, and no amount of work on our side prevents it.
- Turn on two-factor authentication and store the backup codes somewhere other than the device you authenticate with.
- Check the domain is
spendly.appbefore entering credentials.