Sign-in and sessions
- Sign-in is through Google only. KHMYS stores no passwords.
- Browser sessions use an HttpOnly, Secure, SameSite cookie, so page scripts cannot read the session token. State-changing requests also require a CSRF token.
- Sessions expire automatically. In Settings you can see your signed-in sessions, sign any of them out, or sign out of all of them.
- Traffic uses HTTPS, and browsers are told to keep using it.
API keys
- A key is shown once when created and is stored only as a hash.
- Keys have scoped permissions and an expiry (90 days unless you choose otherwise), and you can revoke them at any time.
- Creating a key requires signing in with Google again, and API keys cannot manage sessions or create other keys.
Connected-account tokens
Access tokens for connected providers such as Plaid are stored encrypted in the database. This describes those tokens specifically, not every item of data in the system.
Abuse limits
Requests are rate limited, with tighter limits on sign-in endpoints.
The demo is isolated
The demo runs on its own host with a shared read-only account, so it never uses a real person’s session or data.
Reporting a vulnerability
Please report security problems to [email protected], and avoid accessing other people’s data or disrupting the service while you investigate. Machine-readable contact details are in security.txt.