Block a user
Extract shared storage helper (DATA_DIR/load/save duplicated 7x)
Self-host Google Fonts instead of CDN @import
Replace scattered inline styles with CSS utility classes
Strip template scaffolding comments from the Dockerfile
Remove unused FastAPI suggestions adapter from the image
Add a committed .env.example documenting all env vars
Remove redundant double pip install of gunicorn/requests
Pin the base image by digest
Run the container as a non-root user
Pin python-dateutil, requests, gunicorn in requirements.txt
Cache per-request transaction reads (badge reloads full JSON every page)
Define TAX_FILE after DATA_DIR to avoid divergent fallbacks
Extract shared storage helper (DATA_DIR/load/save duplicated 7x)
Harden income_ytd year filtering (string prefix match)
Recompute freed minimums each month in simulate_payoff
Cap split_transaction's unbounded while-loop
Cast income_delete year/month to int for url_for
Include bills in client-side updateLeftover() in weekly.html
Align upload save path with the /uploads serving route
Replace 30-day-month BNPL approximation with calendar math