Multi-layered Defense in Depth, row-level IDOR mitigation, cryptographic integrity, and continuous security audits.
100% Row-Level Isolation: All transaction, wallet, budget, and split bill endpoints are strictly validated against user ownership (IDOR Shield) at the database tier.
Ledger & Concurrency Protection: Balance mutations are shielded by ACID database transactions and pessimistic row locking to prevent race condition anomalies.
Hardened Auth & HTTP Response Headers: CSPRNG OTP generator (random_int), anti-email enumeration, 'mnf_' token prefix, and bank-grade headers (X-Frame-Options DENY, CSP, nosniff).
Security at MoneFin is an foundational architecture tenet rather than a superficial afterthought. We enforce Defense in Depth and Zero Trust principles across every layer of the tech stack.
Every inbound API request traverses multiple verification boundaries: firewall scrubbing, security headers middleware, anti-abuse rate limits, cryptographic token verification, service-layer ownership authorization, and parameterized query execution.
Insecure Direct Object References (IDOR) represent one of the most critical vulnerabilities in modern web applications. MoneFin implements row-level ownership validation across all controller endpoints.
In controllers including TransactionController, BudgetController, SplitBillController, IncomeSettingController, and CategoryController, every foreign key parameter (such as account_id, category_id, goal_id) is explicitly scoped to verify that the entity belongs to the authenticated user ID:
This mechanism guarantees that User A can never inspect, alter, associate, or debit User B's accounts or categories, even if request parameter IDs are deliberately tampered with.
Every single resource (account, category, transaction, budget, split bill, goal) is strictly validated against the authenticated user ID. Cross-tenant access is unconditionally blocked.
MoneFin deploys robust cryptographic protocols to safeguard data in flight and on disk:
Encryption In-Transit: All network communications between client browsers and backend APIs require TLS 1.3 / HTTPS with ciphers supporting Perfect Forward Secrecy. Unencrypted HTTP requests are automatically upgraded. Internal AI provider HTTP calls enforce strict SSL certificate validation (verify = true).
Password Security At-Rest: Passwords are never stored in cleartext. We employ industry-standard adaptive hashing algorithms (Bcrypt/Argon2id) with unique cryptographic salts to resist brute-force and rainbow table attacks.
Token Hashing: Sanctum authentication tokens stored in our database are maintained as SHA-256 cryptographic hashes; raw tokens are revealed only once upon initial issuance.
In financial software, balance mutation consistency is paramount. Unsynchronized simultaneous operations can produce race condition anomalies.
MoneFin wraps balance updates in ACID-compliant Database Transactions.
We employ Pessimistic Row Locking (SELECT ... FOR UPDATE) on target account records prior to computing credits or debits. This guarantees that concurrent transactions, scheduled recurring batch jobs, and split bill settlements execute sequentially without double-spending or balance desynchronization.
MoneFin's authentication architecture incorporates enterprise-grade hardening:
CSPRNG OTP Generation: 6-digit One-Time Passwords are generated using a true Cryptographically Secure Pseudo-Random Number Generator (random_int()), eliminating the predictability of legacy pseudo-random algorithms (rand()).
Anti-Email Enumeration: Password recovery and OTP resend endpoints return uniform HTTP 200 responses with the generic message: 'If the email exists, an OTP code will be dispatched.' This prevents malicious actors from harvesting registered email directories.
Tiered Rate Limiting: Authentication routes (/api/auth/*) enforce strict per-IP and per-identity throttling to defeat automated credential stuffing and dictionary attacks.
Sanctum Token Prefix 'mnf_': Access tokens are prefixed with 'mnf_', enabling automated code scanning tools (such as GitHub Secret Scanning) to immediately detect leaked tokens in developer environments.
Every HTTP response from MoneFin's backend is armed with comprehensive security headers:
X-Frame-Options: DENY — Prevents clickjacking by forbidding embedding into external <iframe> elements.
X-Content-Type-Options: nosniff — Stops browsers from guessing MIME types, preventing executable payload attacks.
X-XSS-Protection: 1; mode=block — Enforces browser-native Cross-Site Scripting blocks.
Referrer-Policy: strict-origin-when-cross-origin — Prevents internal path leaks when navigating offsite.
Permissions-Policy: geolocation=(), microphone=(), camera=() — Disables superfluous hardware APIs.
Content-Security-Policy (CSP): default-src 'none'; frame-ancestors 'none' — Restricts script origins (with intelligent exemptions for AI streaming Server-Sent Events).
SecurityHeaders middleware is active across all API responses to prevent UI redressing, clickjacking, and MIME-sniffing.
| HTTP Header | Value / Policy | Status & Purpose |
|---|---|---|
| X-Frame-Options | DENY | Prevents Clickjacking |
| X-Content-Type-Options | nosniff | Blocks MIME-sniffing |
| X-XSS-Protection | 1; mode=block | Browser-level XSS filter |
| Referrer-Policy | strict-origin-when-cross-origin | Strict referrer isolation |
| Content-Security-Policy | default-src 'self' + SSE | Script isolation & AI SSE pass |
MoneFin grants you granular control over active login sessions. From the Security Settings dashboard, you can view:
All connected devices and browser user agents associated with your account.
Timestamps of recent activity and originating IP addresses.
The 'Revoke Other Sessions' button, allowing instant termination of foreign sessions with a single click if a device is misplaced or compromised.
To guard against unauthorized tampering when a device is left unattended, MoneFin mandates explicit password re-authentication for high-risk operations.
For example, permanent account deletion (DELETE /api/auth/profile) cannot be authorized with a bearer token alone. The request payload must supply the current password, which is cryptographically verified by the server prior to data purge.
We warmly welcome collaboration with ethical security researchers to help keep MoneFin's ecosystem resilient.
If you discover a potential vulnerability or security gap in MoneFin, please report it responsibly to our dedicated team:
Security Team Email: security@monefin.com
Our commitment: We verify reports within 1 business day, commit to zero legal action against researchers acting in good faith, and honor your contribution in our Security Hall of Fame.
We are dedicated to presenting terms transparently with zero hidden fine print.
