Block a user
Stop load_funds from returning the mutable DEFAULT_FUNDS list
Fix payoff_months divergence guard when monthly_charges>0
Fix amortization float rounding leaving non-zero final balance
Fix simulate_payoff 4th return value double-counting minimums
Validate int() parsing of form year/month (raises 500 on bad input)
Initialize next_num before loop in bnpl_payment (UnboundLocalError 500)
Clamp bills due on day 29-31 in short months (calendar drops them)
Remove dead code and fix off-by-one in current_balance_estimate
Fix biweekly mortgage schedule interest basis (overstates payoff)
Roll back multi-file saves on partial failure
Fix concurrent JSON read-modify-write race (2 gunicorn workers, no lock)
Handle JSONDecodeError in all load_* functions
Make all JSON saves atomic (temp file + os.replace)
Add Subresource Integrity (SRI) to CDN-loaded Chart.js
Guard the /suggestions HTML page with the same auth as its API
Cap pasted statement text size before regex parsing
Make Werkzeug debug mode opt-in instead of debug=True
Escape input in bold_md filter before wrapping in Markup (stored XSS)
Add authentication + CSRF protection to all mutating routes
Add MAX_CONTENT_LENGTH + content-type check to the PDF/CSV import route