Full scan: 28 fixes across security, imports, transactions, accounts, budget and routes

[flaxvin]

Summary

A full scan of the app in six parallel audits: security, imports, transactions, accounts/loans/assets, the budget engine, and every route. Each defect below was reproduced with a test that fails on main, then fixed at the cause. The combined branch is clean on typecheck and passes 2117/2117 tests (main has 2076).

Three problems matter most:

1. Access and privacy. A removed member's API token kept full access. A CAS import could write one member's folio into another member's private holding. Reports showed another member's envelope spending.
2. Silent data loss or corruption. Imports silently dropped rows when the bank's reference column held "-", or failed outright with a 500. A loan payment with a negative half increased the debt. Deleting an envelope that a "call it even" was spent from broke the household's books from that month on.
3. Denial of service. A PDF of a few hundred bytes could stall the server for minutes, through upload or email.

Findings (most severe first)

Sev	Area	Defect	Fix
high	security	A removed member's API token kept full read/write access (e.g. /export.json)	the bearer path checks the member is still in the household
high	security	A few-hundred-byte PDF expanded to gigabytes and held the single-threaded server for more than 2 minutes. Reachable via /import/pdf, /portfolio/cas and the email fetch	32 MB decompression budget per document
blocking	imports	A CAS import filed Ravi's folio into Priya's private holding of the same fund	picks only holdings the importer can see
blocking	imports	Two identical rows plus an auto-approve rule made the whole import fail (500, foreign key)	auto-approved rows join dedupe under their transaction id
blocking	imports	Rows silently dropped when the reference column held "-" or "0000…" (CSV and PDF)	placeholder references are treated as no reference
blocking	loans	A payment split as −₹5,000 principal / ₹15,000 interest was accepted, and the debt went up	negative halves and overpayment refused
blocking	budget	Deleting the envelope a "call it even" was spent from broke the giving budget's identity from that month on	counted as history: refused without a remap, moved with one, undoable
blocking	transactions	The 30-day purge of deleted rows failed on every run once an imported row was deleted, and later housekeeping never ran	purges row by row and releases import pointers
medium	security	Login CSRF on Google/OIDC: the sign-in state was not tied to the browser that started it	a pathayam_oauth cookie must match the state
medium	security	While impersonating with writes on, POST /tokens minted a never-expiring token for the impersonated member	refused (403)
should-fix	privacy	Another member's spending (their envelope, on a household-visible account) appeared in the tag chart, heatmap, trend and FIRE living costs	hiddenTransactionSql in reports and envelopeSpendBetween
should-fix	privacy	A transfer from a private account wrote "Transfer from ‹private account name›" on the joint account's leg	that leg now says "a private account" (existing rows keep the old memo)
should-fix	tax	25%/37% surcharge was applied when only 111A/112/112A gains pushed income over ₹2 crore/₹5 crore	band tested on income excluding those gains. Example: ₹1.5 crore slab + ₹1 crore 111A gives ₹72,71,680 (was ₹76,96,000)
should-fix	accounts	Tracking-account reconciliation moved household Ready to Assign	adjustment kept off budget
should-fix	accounts	An empty budget_id on account edit dropped the account out of every budget	refused
should-fix	accounts	Statement/due days of 45, −3, 0 and 2.5 were stored	limited to 1–31
should-fix	net worth	A past-date net worth used a hand-valued asset's later valuation	valued as of that date
should-fix	loans	A payment larger than the outstanding left the loan account in credit	refused
should-fix	assets	Negative purchase fees reduced a lot's cost	refused
should-fix	transactions	A refused change still marked the reconciliation checkpoint broken	break happens in the same transaction as the change
should-fix	transactions	An edit with date 31-02-2026 kept the old date and said "Saved."	400
should-fix	transactions	A memo-only edit on one leg of an imported transfer moved the other leg's date	other leg moves only when its value actually changes
should-fix	imports	"1 to review" notice when every row was auto-approved	counts only what is still in Review
should-fix	routes	/schedules?days=abc returned 500; ?days=2000000 took about 5 s, then 500	falls back to 60 days; over 3,650 refused (422)
should-fix	routes	"Pay it off" on Cards passed paise and /transfer ignored it, so the form opened empty	carries rupees and the form is prefilled
low	security	A JSON body with an object value produced a 500 (named-parameter binding). Reachable anonymously on the demo	JSON bodies reduced to form shape
nit	routes	"Nothing due in the next -1 days"	fixed with the horizon validation

Coverage and what was clean

• Routes: all 208 exercised, about 42,000 requests. Every GET route was crawled as each of the 4 sim members. Every POST was sent as rendered, empty, and with 19 boundary/garbage values per field. No other 500s, no unescaped markup (the stored XSS probe was always escaped), and no dead links or forms.
• Budget engine fuzz: randomized operation sequences on 40 seeds (300–500 steps each) across household and personal budgets. After every step: identity is 0 in every scope, and the rollup matches a cold compute.
• Security, found sound: CSRF origin checks, safePath redirects, session cookie flags and re-checking on every request, password lockout parity, OIDC issuer/audience/email_verified, output escaping, CSV formula guard, attachment handling, CSP/HSTS/no-store, production gates on dev and demo modes.
• Maths checked by hand: EMI and interest schedules, new- and old-regime tax with the 87A rebate, and capital gains rates.

Not in this PR (decisions or follow-ups)

• "Reduce tenure" prepayment changes the EMI. Example: ₹8,884.88 → ₹8,418.75 on ₹1L/12%/12 months after ₹20,000 prepaid, yet the message says the instalment is unchanged. Keeping the instalment needs a schema column to store it.
• Nits read from code, not reproduced:
  • A crafted rule with op=oneOf and a string value would 500 later imports.
  • A deleted transaction can still be edited.
  • Deleting a card charge that was converted to EMI is not refused.
  • POST /portfolio/refresh can block for about 55 s when the price providers are unreachable.
  • The 80D ceiling for a senior-parent combination is simplified.

🤖 Generated with Claude Code

https://claude.ai/code/session_016zXWwzys3K4XksLh3rrcKu

---

Generated by Claude Code

[flaxvin]

The github-advanced-security check (run 36310637304) failed for the same reason as on #1 and #2. Nothing in this PR caused it.

GitHub's hosted AI scanner stopped before it read any file. It failed while opening its model session: CAPIError: 400 The requested model is not supported. No findings were produced. Nothing in this repository sets that model, so this PR can't fix it.

On #1 the API refused to re-run this kind of check (403 This workflow run cannot be retried), so I haven't re-run it here.

The PR's own checks on edd8e1d: npm run typecheck is clean and npm test passes 2117/2117.

---

Generated by Claude Code