Security
Coffer holds financial information. It is built to collect only what it needs, to be unable to move money, and to protect what it holds. This page describes how, and how to report a security concern.
How Coffer is built
- Read-only by design. Coffer requests read-only, non-payment access through Akoya. It has no capability to start payments, transfers or trades.
- No institution passwords. You sign in on your institution’s own website. Coffer never sees or stores your username, password or security answers.
- Encryption. All connections use HTTPS with HTTP Strict Transport Security. Credentials issued by Akoya are encrypted with authenticated encryption before they are stored.
- Protected connections. Each connection link works once and expires after 15 minutes. The authorization that follows is protected with OAuth 2.0 and PKCE. A credential issued for a different institution than the one chosen is refused.
- Access control. Connecting an institution requires signing in. Software that reads Coffer information must be authorized through OAuth 2.0 and receives access that is scoped and expires.
- Isolated infrastructure. Coffer runs in unprivileged containers with read-only file systems. Its database is reachable only from Coffer’s own containers. A firewall admits only web traffic and key-based administrative connections, and operating system security updates install automatically.
- Hardened pages. Coffer’s pages load no third-party scripts, send a strict Content Security Policy, and cannot be embedded in other sites.
- Minimal data. Coffer keeps only the last four digits of account numbers, does not request identity details from institutions, and removes query strings from request logs.
- Tested changes. Every change must pass an automated test suite before it can be deployed.
How information is collected, used, shared and deleted is described in our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security vulnerability in Coffer, email security@bouncingpebbles.com with enough detail for us to reproduce it. We acknowledge reports within two business days and will keep you informed as we investigate.
When researching, please:
- test only against your own account and information, and never access, change or delete anyone else’s;
- avoid anything that degrades the service, such as denial-of-service testing, spam or social engineering; and
- give us reasonable time to fix an issue before you disclose it.
If you follow these guidelines and act in good faith, we will not pursue or support legal action against you for your research. We do not currently offer a bug bounty.
Machine-readable contact details are published at /.well-known/security.txt.