Actual Budget sync servers: exposure checks show limited title matches

·11 views

An Actual Budget sync server stores synchronization data for budgets and can optionally use end-to-end encryption, but a reachable server does not automatically expose readable budgets. According to the project's documentation, the server requires a password before granting budget access, and end-to-end encryption is an optional layer derived from a password. A ZoomEye observation on 2026-11-01 returned 0 app-fingerprint matches and 11 title matches, a small sample that may include documentation pages and is a weak basis for any global exposure claim. The article recommends reviewing the login method, TLS setup, storage permissions, client inventory, and whether bank-sync secrets, which end-to-end encryption does not cover, need separate review. The authors caution that the observation should not be presented as a vulnerability count.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Researcher Shows How Web3 Frontends Can Expose Unauthenticated API Endpoints

A security write-up explains how analysts can reverse engineer a Web3 application's minified JavaScript bundles to locate hardcoded backend API URLs. The author argues that because blockchain transactions are slow and costly, many Web3 apps depend on centralized APIs for prices, fees, and user data. By mapping routes that the frontend calls, the researcher identified several endpoints, with some correctly rejecting unauthenticated requests. One endpoint listing all ecosystem tokens, however, responded with a large JSON payload to a request lacking any credentials. The piece warns that the exposed data, including internal testnet contract addresses and hidden tokens, could aid targeted attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Publishing an App Was Harder Than Coding It, Developer Says

A developer who built MacroScout, a calorie tracker for iPhone and Android, found that the difficulty of launching the app lay in meeting App Store requirements rather than writing the code. The account describes App Store rules as external standards that must be read, interpreted for the specific app, and then applied through changes. Key figures cited include a $99 annual Apple Developer Program fee, a one-time $25 Google Play registration fee, and Apple's typical review of 90% of submissions within 48 hours. The developer also notes that new personal Google Play accounts must complete a closed test with at least 12 testers over 14 days. The developer advises keeping a running list of platform rules from the start of development and checking it throughout the build process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two easily missed details in paginated ASP.NET Core CRUD: sort ties and duplicate emails

A customer CRUD application can appear finished through the UI, yet two less visible behaviors need careful attention. The first concerns sorting, where records with equal sort values have no guaranteed order unless the unique ID is added as a secondary key. The second concerns duplicate email addresses, which an existence check alone cannot fully prevent when concurrent requests race, so a database unique index and translation of the resulting SQL Server error into a 409 response are also needed. The author's example clamps page parameters and warns that offset pagination still does not provide a consistent snapshot when records change between requests. The duplicate-email translation also assumes any uniqueness failure means a duplicate email, which must be revisited if more unique constraints are added. These observations come from a local demo and prior verification, not a production-readiness claim.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mirza Games Explains How Its Browser PDF Compressor Hits Exact File Sizes Without Uploads

Dubai-based indie studio Mirza Games, which publishes on Google Play as Sezarr, has detailed how its PDF compression tool reduces files to a user-specified size entirely within the browser. The tool targets common needs such as government forms and job portals that impose strict file size limits. Processing relies on WebAssembly builds of qpdf, pdf-lib and pdf.js running in Web Workers, so files never leave the user's device. The engine applies lossless optimisation first, then progressively more aggressive steps, returning the first result that meets the target. Memory-based render caps on weaker devices mean very large files may be slower or rendered at lower resolution.

0 comments Read more at DEV Community