The workflow
- A user or guest uploads a receipt image.
- The application normalizes the image and stores receipt data.
- Participants assign items and calculate their share.
- A bounded share link lets invited people view or work with the receipt without exposing the rest of the account.
Application shape
The backend uses Flask and SQLite with server-rendered templates plus browser-side JavaScript for interactive steps. A Capacitor wrapper supports a mobile application path while the same core workflow remains available on the web.
Defensive design
- Upload type, size, and image dimensions are validated before the file becomes application data.
- Images are normalized rather than trusted in their original uploaded form.
- State-changing requests use CSRF protection, while session cookies use restrictive browser attributes.
- Share tokens are designed to be unguessable and expiring, with access scoped to the shared receipt.
- User and guest quotas place limits around resource use.
- Administrative access adds MFA and the ability to revoke sessions.
- Security headers, including CSP, narrow what the browser is allowed to execute.
The important boundary
A share link is a capability: anyone who has it may be able to access its scoped content until it expires or is revoked. That makes token strength, limited scope, expiration, and avoiding sensitive receipt content part of the product design—not an afterthought.
Operational visibility
The application includes operational metrics and administrative controls so abnormal use and application health can be investigated. The next level of maturity is exercising those controls through repeatable incident and recovery tests.