See how sure compares to other vendors in security performance
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.