Security

Security is part of the product path, not an add-on.

debtmo is intentionally manual-first while the authenticated data path is pending. Paid Plaid sync should wait until server, database, and billing controls are verified.

Get early access Try sample dashboard

Current production posture

The public website and sample planning experience are designed for free manual planning without collecting banking credentials. The demo uses local browser state for planning data and public routes for the current marketing pages.

Security headers are set at the Vercel edge through the project proxy.

API routes validate payload shape before accepting requests.

The AI coach route currently returns local sample guidance instead of sending private debt context to a model.

Before paid Plaid sync

Plaid sync should be a paid upgrade only after Supabase Auth, row-level security, server-side ownership checks, Zod validation, billing state, and migration coverage are verified.

Apply and verify the SQL policies before exposing persistent user-data APIs.

Exchange Plaid public tokens only in authenticated server-side routes.

Keep service role keys, Plaid secrets, and provider access tokens server-only.

Before AI and billing integrations

AI and payment providers should be added behind authenticated server-side routes with input minimization, rate limits, webhook verification, and failure logging that avoids sensitive prompt or payment details.

AI prompts should be redacted and minimized to the task at hand.

Stripe webhooks must verify signatures before changing account state.

Operational logs should capture event state, not raw financial context.