2 posts tagged with "open-source"

In January 2026, curl shut down its bug bounty program. Six years, $86,000 in payouts, and a steady stream of real vulnerabilities — ended not because the money ran out, but because the signal did. Historically, more than 15% of submissions turned out to be confirmed vulnerabilities. By late 2025 the rate was closer to one in twenty or one in thirty, and submission volume had spiked to eight times normal. The queue was full of long, confident, completely fabricated reports — one came with GDB sessions and register dumps referencing a function that doesn't exist in curl at all.

Here's the uncomfortable part: the people generating that flood aren't villains. Many of them are engineers like you, running agents like yours, pointed at repositories like the ones your product depends on. AI collapsed the cost of producing a contribution to near zero. It did nothing to the cost of reviewing one. Every economic system with that shape — cheap to emit, expensive to absorb — turns into a spam problem, and the absorbing side is a volunteer who was already unpaid before your agent showed up.

Beancounters traditionally use command-line tools or self-host servers with private networks, where they have to operate through a computer or a general-purpose text editor on mobile. Beancount.io reduces hassles by bringing open-sourced Android and iOS mobile apps and a secured cloud so that your ledger is now a few taps away from your fingerprint.

Beancount is a computer language that enables double-entry bookkeeping in text files. Once you define financial transactions in the file, it will generate various reports. Martin Blais, the designer of this language, argues that command-line bookkeeping has many advantages - It is fast, portable, open, and customized.

We strongly agree with the argument and share the feeling of empowerment brought by beancount language. And we wanted to do more - introducing the technology to more people. It means that we have to improve the usability and make it more accessible to a broader audience.

Not everyone is a command-line enthusiast, and this is why we build Beancount.io - the personal finance manager for everyone. Here is how it works:

For heavy-duty work, beancounters could still use their computers to edit or view the ledger with their browsers visiting https://beancount.io or syncing with Dropbox. This keeps the flexibility of the command-line tools, while not losing the cross-device access of the cloud-based solution.

For daily light-weight operations, such as instantly adding an entry, beancounters could use the mobile app to connect to the secured cloud.

Mike Thrift, a backend engineering working on this product, says

I used to set up a reminder every day for myself to open my laptop and input records to my bean files. Now, with beancount.io, it is way easier for me to modify my ledger whenever I need it, even when I am outdoors purchasing something in the store.

Zhi Li, a software engineer from Facebook, tells us

I have migrated all my beancount files to beancount.io, and now it works perfectly for my day-to-day usage. I have paid for Pro features like automatic data backup, but I feel there are more things you guys could do to improve the service.

You could sign up now at https://beancount.io/sign-up/ or download iOS or Android App. We streamlined the registration to collect as minimal information as we can from you to bootstrap the service. Then you will get a preset empty ledger that is ready for you to add an entry right away.

FAQs​

Would beancount.io sell my ledger data to any third party?​

• No. We are committed to keeping your data secured and private, and we will never sell your ledger data.

Is my data secured?​

• Yes. We protect your email and ledger with AES256, your password with BCrypt, and your network requests with SSL.

Is my ledger data end-to-end encrypted?​

• No. Due to technical constraints, we still have to decrypt your data into memory when indexing the ledger file in production servers. Therefore, we restrict direct access from any of our team members. Unfortunately, we cannot do this in Intel's SGX or any security vault due to high costs.

Is this a reliable service I could trust for the incoming few years?​

• Yes. We initially launched Beancount.io on July 4th, 2019, and it has been more than two years that we have operated the service securely and reliably. Therefore, we have no reason not to continue the service in the future.

Can I request new features and sponsor the project?​

• Yes. Please feel free to reach us at https://t.me/beancount for any feedback and support us by becoming a Pro user at https://beancount.io/pricing.