If you discover a security vulnerability in Budget Analyzer, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, email security@budgetanalyzer.org with:

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact
4. Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Resolution timeline: Depends on severity, typically 30-90 days

This policy applies to all repositories in the Budget Analyzer organization:

• orchestration
• session-gateway
• transaction-service
• currency-service
• budget-analyzer-web
• service-common

Budget Analyzer implements defense-in-depth security patterns. Browsers authenticate through Session Gateway, receive an opaque BA_SESSION cookie, and keep the server-side session alive with same-origin GET /auth/v1/session heartbeats. Session state lives in Redis hashes that ext-authz reads at the Istio ingress, so browser clients never receive long-lived API tokens.

For details, see:

• Security Architecture
• Session Security Benefits

We provide security updates for the latest release only. This is a reference architecture, not production software with LTS guarantees.

We appreciate security researchers who help keep Budget Analyzer secure. With your permission, we'll acknowledge your contribution in our release notes.