Settings

Configure plan preferences and review the privacy boundaries for account sync.

Plan settings

Local settings form with Zod validation. Production saves should run on the server.

Authorization rule

Do not rely on proxy headers for authorization. Re-check the user in Server Actions and Route Handlers.

Connection roadmap

Boundaries to keep real financial data protected.

Require a verified user before reading or changing debt records.

Keep row ownership rules active before account data sync is enabled.

Run coaching requests server-side with prompt redaction and rate limits.

Keep billing checkout and webhooks in server-only modules.