MEDIUM: 10x .catch(() => {}) silently swallowing errors in client code
MEDIUM: Floating-point REAL type for monetary amounts in SQLite
HIGH: No explicit JSON body size limit on express.json() - default 100KB
HIGH: No process-level unhandledRejection/uncaughtException handler
HIGH: Payment UPDATE/DELETE lack user_id in WHERE clause (defense-in-depth)
HIGH: SQL injection surface in analyticsService.js - string interpolation in WHERE clause
CRITICAL: Incomplete user deletion - orphaned data risk
CRITICAL: SMTP password stored in plaintext in SQLite
CRITICAL: Async route handlers lack try/catch - unhandled rejections crash process
90cfed035b
feat: Payoff Custom mode, Summary reordering, unifed billing schedule, SimpleFIN + backup fixes (batch v0.34.1.3)
c23cae1107
feat: reordering across management pages (Bills, Subscriptions, Categories, Snowball) — batch v0.34.1.2
8b0f33085c
feat: Payoff Simulator page with live SVG chart, debt selector, and apply-to-budget (batch 0.34.3)