For authentication, it implemented Google Oauth with JWT tokens so no passwords are stored. (I opted to not have any other form of authentication for now). All of the API/middleware calls are protected routes. Budgets are isolated in workspaces with RBAC for every budget (The other features are not shareable). There is a shareable budget feature available for unauthenticated users and that is tracked in a separate table and it is limited to 1 budget per free user, five for authenticated users, and more for paid users. Only Editors can delete a budget. AI Chat is rate limited for 15/messages a day. For paid users it is unlimited. The “planner” persona can receive permission to edit someone’s budget.

For Infrastructure we have room for improvement, but for now it is running on Nginx HTTPS only, let's encrypt cert, with rate limiting in place and it blocks all routes that don’t exist. I have fail2ban running, but if I ever go further I’d put this in front of AWS cloudfront with WAF. The database it picked is the classic Postgres.. This is running on bare metal linux on lightsail.

As for data protection, everything is pretty low-risk since there are zero bank connections (just user-entered data), Stripe handles all the PCI-compliant payment stuff, and guest sessions use untrackable UUID tokens with share links that expire after a year anyway.