I’ve used YNAB for about 10 years and have features I want that it doesn’t offer, plus net worth tracking. I have \~3 years of experience in data engineering and app dev pre-AI, but I’d use Claude Code to generate most of the code.
I’m comfortable with foundational security fundamentals: OAuth, authentication vs. authorization, salting and hashing passwords, masking sensitive data, least-privilege access, and other core principles. I’d review all the code myself, and go line by line on anything touching security or user data.
Building it for myself feels fine. Opening it to other people is where I’m worried about lawsuits or losing someone’s financial data.
Questions:
- Is my own careful review enough, or would I need an external audit or pen test before letting others use it? Roughly what does that cost for a small app?
- If I release it, should I say up front that it’s mostly AI-coded?
- What’s the smartest way to scale this without extreme risk? Local-first, self-hosted, open source, CSV import instead of bank connections, something else? Or is it not worth taking beyond personal use at all?
