Built like it has to hold money.
CashPilot targets OWASP ASVS 5.0 Level 2 for the application layer and keeps card data out of scope entirely with Stripe's hosted Checkout. Every release must pass an automated acceptance checklist; the current one runs 26,863 checks, all passing, and is readable inside the product.
What is verified, and how.
| ASVS 5.0 chapter | Control in CashPilot | Verified by |
|---|---|---|
| V1 Encoding | Template autoescape everywhere; Decimal money; parsers reject malformed input and XML entities | Template audit, stored-XSS probes |
| V2 Validation | Pydantic models; bounded pagination; enumerated sorts and statuses; length-capped forms | 422 and injection probes |
| V3 Web frontend | CSP, X-Frame-Options, nosniff, referrer and permissions policies, COOP; no inline handlers | Header matrix on every page |
| V4 API | Hashed, scoped, revocable bearer keys; rate limit with standard headers; JSON errors | API and rate-limit checks |
| V5 Files | Upload size limits, format detection, no execution, server-side exports | Upload probes |
| V6 Authentication | scrypt; 10+ char policy with denylist; per-IP+email throttle and lockout; generic errors | Weak-password and lockout probes |
| V7 Sessions | Signed cookie, HttpOnly, SameSite=Lax, Secure in production, 12 h; logout invalidates | Cookie and tamper checks |
| V8 Authorisation | Four roles; every route declares a minimum role; every query scoped by organisation | Routes × roles matrix, tenancy checks |
| V9 Tokens | Reset and simulated-checkout tokens signed, time-limited and bound to the password hash | Reset-token checks |
| V11 Cryptography | Fernet for provider secrets; HKDF key derivation; constant-time comparisons | Round-trip and masking tests |
| V12 Transport | TLS at the edge with automatic certificates; HSTS; X-Forwarded-Proto honoured | Transport checks |
| V13 Configuration | Secrets in .env (mode 600); no debug endpoints; non-root container; pinned dependencies; Alembic | Ops checks over SSH, source audit |
| V14 Data protection | Per-tenant isolation; administrator export; secrets never rendered; 192-bit rotatable portal tokens | Export and masking checks |
| V16 Logging | Structured JSON logs with request ids; audit log for every mutation; generic errors to clients | Log and audit checks |
PCI DSS scope: SAQ A
Card entry happens on checkout.stripe.com. CashPilot never receives card numbers. Merchants qualify for SAQ A (v4.0.1, January 2025 revision), provided their own pages carry the script-integrity protections CashPilot ships: a strict Content Security Policy and Subresource Integrity on the single CDN script.
Webhooks are verified on the raw body with HMAC-SHA256 (t=/v1= parsing, 300-second tolerance, constant-time compare, multiple v1 values for secret rotation), made idempotent on the event id inside a database savepoint, and the checkout session is re-fetched from Stripe before any ledger change. Every signature problem is a 400 with an audit entry.
Bank data
Statements are parsed with the standard library; XML entity declarations are rejected; amounts are exact decimals; duplicates are rejected per account and transaction id. Open-banking credentials for Plaid and GoCardless are encrypted at rest, sync cursors persist per account, and every sync and application is audited.
Reporting a vulnerability
Email hello@cashpilot.app with steps to reproduce. We acknowledge within two business days and aim to ship fixes for high-severity issues within seven.
Deployment options
Multi-tenant cloud, a dedicated instance, or on-premise in your own cloud account. The product ships as two containers and a Postgres database; the same release checklist runs against every deployment.
Stop financing your customers’ cash flow.
Import a CSV and see your own ranked worklist and 13-week forecast in about ten minutes. Or click around the live demo workspace with 18 months of ledger history.