Security model
CanCan handles financial evidence, so its security boundary is deliberate and narrow: an encrypted local Vault, OS-managed secrets, and no hosted surface.
How CanCan protects your data
- The Vault is a SQLCipher-encrypted database and encrypted file store on your Mac, unlocked by your password with an Argon2id-derived key.
- Vault keys, remembered unlock, statement passwords, and OAuth refresh tokens live in the macOS Keychain.
- Document viewing renders in memory — no plaintext temp files. Source files are copied into the Vault with verified bytes and SHA-256 identity; duplicates and deleted files are handled deterministically.
- The renderer never receives raw file bytes, filesystem paths, hashes, locators, or database handles — only bounded, presentation-safe read models.
- Network access exists only for connections you enable: Gmail (official API, read-only scope), your own AI provider, and optional update checks that verify signed metadata.
- Releases are CI-built from immutable tags with checksums, signatures, and provenance — never developer-machine builds.
Reporting a vulnerability
Please report security issues privately — never in a public issue, discussion, or pull request.
- When the repository is public, use GitHub private vulnerability reporting so we can coordinate a fix and disclosure.
- The address
security@cancan.moneyis intended as the private contact and is being provisioned; until it is verified, the GitHub route (or direct contact with the maintainer) is authoritative. - Do not include real financial data, account numbers, or secrets in a report — redacted reproduction steps are enough.
Supported versions
CanCan is in a pre-1.0 preview line. Only the latest published 0.x Preview release receives security fixes; fixes ship as new releases, never as silent patches. A security-critical update is explained prominently in the app and still waits for your approval to install.