Security hardening, self-healing syncs, and document imports

The weekly cadence slipped, so this is a single catch-up covering May. June follows in the next entry.

Sign in to connect Redbark to Claude

The MCP server now supports OAuth. You can connect Redbark to Claude or any other MCP client by signing in through the browser, instead of pasting an API key into a config file. Connected apps are listed in your settings, and you can revoke any of them whenever you want.

A full security audit of the API

I put the API and MCP server through an OWASP API Top 10 audit and fixed everything it turned up, along with the findings from an external penetration test. Alongside that, a batch of correctness work on the API: brokerage endpoints now validate properly and return a clear 400 instead of a confusing error, validation errors all share one shape, and upstream bank failures surface as real errors rather than being quietly swallowed or cached as empty.

Syncs that fix themselves

A few classes of breakage now recover without you touching anything. When a bank regenerates its internal account IDs, Redbark re-matches your accounts instead of stalling. If you repoint an account mapping at a different destination, it backfills automatically. Brokerage connections repair their own end-user mapping if it goes missing. And when you revoke consent at your bank, the connection is now cleaned up properly on both sides.

Statements and receipts, extracted for you

Late in the month the document extractor went into beta. Upload a PDF statement or a receipt, or forward it to your own Redbark inbound address, and the transactions get pulled out and synced to your destination like any other transaction. Useful for the accounts Open Banking doesn't reach.

Smaller improvements

YNAB syncs now skip transactions older than YNAB's own five-year window instead of erroring on them, trial users have API access again, and the dashboard sidebar is grouped into sections so it stays readable as the product grows.