Skip to main content

​
Confirmation dialogs could run script from bank-provided names

In earlier versions, confirmation dialogs (such as those shown when deleting a provider merchant, resetting holdings, or replacing a SimpleFIN account) interpolated user-supplied names directly into the dialog body via innerHTML. Names sourced from bank feeds, brokerage providers, or other family members could contain HTML that the browser executed as script. Because provider merchant rows are shared across families, a crafted merchant name could reach any user who opened a confirmation involving that merchant.
Confirmation dialogs that showed a record name in the body text, including:
  • Provider merchant deletion confirmations (the merchant name came from bank feeds and was shared across families)
  • SimpleFIN account replacement prompts (account name from the bank)
  • SnapTrade brokerage and holdings reset confirmations (brokerage name and ticker symbols from the provider)
  • Any other confirmation built through CustomConfirm or the raw turbo_confirm hash that included a record name
The confirmation dialog now sets its body using textContent instead of innerHTML. Record names are rendered as plain text regardless of how the confirmation was constructed, so HTML in a name is never parsed or executed.Upgrade to the latest release to get this fix. No configuration change is required.

​
Category avatar preview does not update when picking a color

When editing or creating a category, changing the color using the color picker previously did not update the avatar preview — the icon and background appeared to stay at the original color until the form was saved.
The category avatar uses a --avatar-color CSS variable to compute both the background (a light tint) and the icon color (the full color). Earlier versions of the color picker updated the avatar’s inline style.color and style.backgroundColor directly instead of setting the variable. Overriding the resolved values bypassed the theme-aware color-mix logic, so the preview stayed stuck at the last saved color.
The color picker now updates the --avatar-color CSS variable on the avatar element when you select a new color. The avatar’s CSS reads from the variable, so both the background tint and the icon color update immediately as you pick.Upgrade to the latest release to get this fix. No configuration change is required.

​
Account shows an error when a foreign-currency transaction has no exchange rate

If an account holds transactions in a currency that has no exchange rate available for a given date, earlier versions would abort the entire balance calculation for that account, marking it as errored even though all transactions had imported correctly.
Balance calculation converts each entry into the account’s base currency. When no exchange rate exists for the currency pair on a specific date, Sure previously raised an error that escaped the calculation loop. A single unconvertible entry was enough to produce no balances at all and leave the account in an error state.
Sure now skips the unconvertible entry rather than aborting. The entry is excluded from the balance total, the missing rate pair is written to Settings → Debug under the sync category, and the rest of the account’s transactions are still used to calculate balances normally.Holdings with a missing rate are handled differently: they are still counted toward the total at a 1:1 rate (to avoid phantom cash appearing in the cash balance), and the occurrence is also logged.To see which rate was absent, go to Settings → Debug and filter by the sync category. Look for entries from Balance::SyncCache with level warn.Upgrade to the latest release to get this fix. No configuration change is required.
Go to Settings → Self-Hosting and confirm an exchange rate provider is configured. Twelve Data is the default. After configuring or re-enabling a provider, trigger a manual sync on the affected account. Once rates are fetched, the previously skipped entries will be included in the next balance calculation.

​
Every click on the reports page navigates to a transaction drill-down in Safari

In Safari, clicking anywhere on the reports page — including the period picker or other controls — could unexpectedly navigate to a category’s transactions drill-down instead of performing the intended action.
The category rows in the reports breakdown use a stretched link whose overlay was anchored to the parent <tr> element. CSS 2.1 §9.3.1 leaves position: relative on table rows undefined, and Safari does not implement it. The overlay therefore resolved against a much larger positioned ancestor, blanketing the entire reports page and intercepting every click. Chrome and Firefox establish the containing block on the row itself, so the issue was invisible in those browsers.
The stretched-link overlay is now anchored to the flex wrapper inside the category cell — a <div>, which is an unambiguous containing block in every browser engine. The clickable area narrows from the whole page to just the category cell (icon, name, and entry count), which is the intended behavior.Upgrade to the latest release to get this fix. No configuration change is required.

​
Debugging rule failures

When an async rule run fails (for example, during a family sync or after a provider webhook), the error is written to the debug log. To view it:
  1. Go to Settings → Debug
  2. Filter by the rules category
Each entry includes the error message and the rule that failed. This is useful for diagnosing why auto-categorization stopped working after a provider or model change.

​
When Rules Are Triggered

Rules run automatically during family syncs or can be triggered manually. Understanding when rules execute helps troubleshoot categorization issues.
Rules can be manually triggered in the following ways:
  • Clicking “Re-apply” on an individual rule in /settings/rules
  • Clicking “Apply All” in /settings/rules
  • Running the rake task: bin/rails rules:apply_all[family_id]
Rules with active: true run automatically when a family sync occurs (Family::Syncer.perform_sync):Scheduled syncs:
  • SyncAllJob - runs daily at 2:22 AM for all families
  • SyncHourlyJob - runs every hour (for items that opt-in to hourly syncing)
Triggered syncs:
  • Provider webhooks (Plaid, etc.) - triggers sync which eventually propagates to family
  • Manual sync button on accounts page
  • After CSV imports complete (Import model calls family.sync_later)
Rules are not triggered in these scenarios:
  • Manual transaction creation - Only triggers an Account sync (not Family sync)
  • Manual transaction editing - Same as above, only Account sync runs
  • Inactive rules - Rules with active: false never run automatically, only via manual “Re-apply”
Failures during async rule runs (including auto-categorize provider failures) are written to the debug log. To view them:
  1. Go to Settings → Debug
  2. Look for entries with category rules
Each failed run includes the error message and the rule that triggered it.

​
Rule run failures not visible in the UI

When rules run asynchronously (during a sync or via a background job), failures are not surfaced in the main UI. If auto-categorization or merchant detection appears to stop working silently, check the debug log.
Failures from background rule runs — including auto-categorize provider errors — are written to the debug log. To view them:
  1. Go to Settings → Debug
  2. Filter by the relevant category (e.g., rules or auto_categorization)
A request that was enqueued but has no matching start entry in the log means the job never reached a worker.

​
Category Rule Popup Behavior

When you select a category for a transaction, a prompt appears to create an automatic categorization rule. This prompt has two controls:
  • X (close) — removes this individual prompt only. It makes no server call and does not affect future prompts.
  • Hide for today — hides all rule suggestion prompts for 24 hours. A note below the buttons reads “Hide for today pauses these suggestions for 24 hours.” so the behavior is always visible.
There is also a Don’t show this again checkbox that permanently disables rule prompts for your account. The prompt is gated by several conditions:
The prompt only shows when all of these conditions are met:
  1. You have not disabled rule prompts (rule_prompts_disabled is false)
  2. You have not clicked Hide for today in the last 24 hours
  3. The transaction category actually changed
  4. No existing rule already sets this category for similar transactions
  5. The transaction has a category assigned
Check these common reasons:
  • Recently snoozed: You clicked Hide for today — wait 24 hours for prompts to resume
  • Rule already exists: A matching rule may already be in place
  • Prompts disabled: Check if rule_prompts_disabled is enabled for your account (set via Don’t show this again)

​
Sure Doesn’t Work Over HTTPS

If Sure behaves incorrectly or fails when accessed over HTTPS, it’s usually due to missing SSL-related configuration between Nginx and Rails.
Sure relies on correct protocol headers to determine whether a request is secure.
When HTTPS is terminated at Nginx but not properly forwarded to the app, Rails may treat requests as HTTP.
Apply the following configuration changes:
  1. Nginx Ensure HTTPS is forwarded to the upstream app:
  2. docker-compose.yml In the x-rails-env: &rails_env section, set:
    This tells Rails to treat all requests as HTTPS.

​
Some pages break over HTTPS

Sure uses WebSockets for certain pages. If some pages fail to render correctly or break entirely, this is often caused by missing SSL or upgrade headers in your reverse proxy configuration.
You may see pages partially load, fail completely, or errors similar to:
This indicates that the WebSocket upgrade request is not being forwarded correctly.
Ensure your Nginx configuration includes the required WebSocket headers:
These headers allow Nginx to properly handle WebSocket upgrade requests over HTTPS.
Self-hosted setups using a forward-auth proxy (Authelia, Authentik, Traefik forward-auth, etc.) may see 500 errors when clicking the Income or Expense drill-down links on the dashboard’s Money In / Out widget. The links work fine when accessed directly.
The drill-down links previously included every accessible account ID as explicit query parameters. With many accounts, the resulting URL could exceed several thousand characters. Forward-auth proxies forward the full URL to the auth service in a request header; if that header exceeds the proxy’s read-buffer or header-size limit, the request fails with a 500 before it reaches Sure.
Sure now omits the account_ids parameter when the widget’s selected accounts exactly match the user’s full set of accessible accounts — the same default the transactions page uses when no filter is applied. The result is identical, but the URL stays short.When a family has accounts excluded from reports or tax-advantaged accounts (so the eligible set differs from the accessible set), the IDs remain explicit to preserve the correct scope.Upgrade to the latest release to get this fix. No configuration change is required.
If you cannot upgrade immediately, increase the header buffer size in your proxy. For Nginx acting as a forward-auth proxy:
For Traefik, set forwardAuth.tls.insecureSkipVerify is unrelated — instead configure your auth service to accept larger headers.

​
Deleting an account with many transfers is slow

When you delete an account, Sure removes all transfers linked to its transactions. In older versions, this process issued a separate database query for each transfer’s associated transaction records, causing it to slow significantly when an account had hundreds of transfers.
Sure now loads all transfer transaction associations in a single query before starting the deletion loop. Deleting an account with a large transfer history completes in roughly constant time regardless of the number of transfers involved.Upgrade to the latest release to get this fix. No configuration change is required.

​
Provider connection stuck on “Deletion in progress”

If a provider connection shows “Deletion in progress” indefinitely and never disappears, the background deletion job may not have been queued successfully.
When you delete a provider connection, Sure marks it as scheduled for deletion and enqueues a background job to remove it. If the job queue (Redis) was unreachable at that moment — or if an enqueue callback rejected the job — the flag stayed set with no job queued. The connection dropped out of the active list and could never be synced again, but it was never actually deleted.
Sure now restores the deletion flag when the enqueue fails, so the connection returns to its normal state rather than staying stuck. If the job queue is temporarily unavailable, you can retry the deletion once the queue is healthy again.Upgrade to the latest release to get this fix. No configuration change is required.
If a connection is already stuck on an older version, triggering a fresh deletion from Settings → Providers will re-enqueue the job once the queue is reachable. If the connection does not respond to deletion, verify that your worker container and Redis are healthy:
Once the worker is running and Redis is reachable, attempt the deletion again.

​
Budget totals do not update after deleting transactions

If a budget still shows spending from a transaction that was already deleted, the most likely cause is a stale aggregate cache. Sure hard-deletes the transaction entry, so the deleted transaction is gone; the stale value can come from cached budget or income totals that were not invalidated by deleting an older entry.
Budget totals are derived from entry aggregation queries. Older versions of Sure used the most recent entry update timestamp as part of the cache key, which meant deleting an older transaction could leave the cache key unchanged.
The entry aggregate cache version now includes both:
  • The current entry count
  • The newest entry updated_at timestamp
Because the count changes when an entry is deleted, budget and income aggregate caches are invalidated even when the deleted transaction was not the most recently updated entry.
Confirm the installed version includes the cache invalidation fix for Family#entries_cache_version, then re-check the affected budget after the next request or cache refresh. The regression test is:

​
Chat fails immediately on a fresh family with a strict OpenAI-compatible provider

Some strict OpenAI-compatible providers (not OpenAI itself) reject chat requests with a schema validation error when a family has no accounts, categories, merchants, tags, or tickers yet.

​
Rule runs fail silently

If auto-categorization or merchant detection rules appear to do nothing, the background job may have failed without surfacing an error in the UI.
Async rule run failures are now logged to the debug log. Go to Settings → Debug and look for entries from the rule_run category. Each failed run includes the error class, message, and the rule that triggered it.You can also check worker logs directly:
Common causes include:
  • LLM provider errors — The AI provider returned an error or timed out. Check your OPENAI_ACCESS_TOKEN and provider connectivity.
  • Auto-categorize provider failures — The provider returned an unexpected response format. These are now propagated and logged rather than silently swallowed.
  • Worker not running — Rules run in the background via Sidekiq. Verify the worker container is healthy.

​
App crashes for a family with an invalid timezone

If a family’s timezone setting contains an unrecognized IANA zone name (for example, after a tzdata rename like Europe/Kiev → Europe/Kyiv), Sure now falls back to the application default timezone instead of crashing.

​
Chat fails immediately on a new account with a strict OpenAI-compatible provider

Some strict OpenAI-compatible providers (not OpenAI itself) reject chat requests with a schema validation error when a family has no tags, merchants, or categories yet. This happens because the assistant’s tool schemas include enum fields built from family data — an empty family produces enum: [], which is invalid JSON Schema.
Sure builds tool schemas for the assistant using family data (account names, categories, merchants, tags, tickers). A family with none of this data produces enum: [] for those fields, which is invalid JSON Schema. OpenAI tolerates it, but strict providers reject the entire request before the model runs. Family#timezone is a free-text field. If the stored value becomes stale — due to a tzdata rename, a database restore from an older backup, or a direct database edit — the app previously raised an ArgumentError on every request for that family, including the login page.
Sure validates the timezone value against ActiveSupport::TimeZone before using it. If the value is unrecognized, the app falls back to the default timezone and logs a warning to Settings → Debug under the timezone category. The log is debounced to once per day per family so it does not flood the debug log.To fix the root cause, update the family’s timezone to a valid IANA zone name from Settings → Profile. Sure builds tool schemas dynamically from your family’s data (account names, categories, merchants, tags, tickers). When none of that data exists yet, the schema contains enum: [], which is invalid JSON Schema. OpenAI tolerates it, but strict OpenAI-compatible providers reject the entire request before the model runs.
Empty enum arrays are now pruned from tool schemas before the request is sent, falling back to a plain string type. This fix applies to both chat tool definitions and the /mcp endpoint’s tools/list.If you are on an older version and cannot upgrade, add at least one account, category, or tag to the family — this populates the enum and avoids the empty-array case.

​
Chat shows “assistant not available” before the model finishes

Self-hosted users running a local model (Ollama, LM Studio, etc.) may see the chat fail with “assistant not available” even though the model is still generating a reply and tokens are being billed.
Sure uses a whole-turn watchdog (AI_RESPONSE_TIMEOUT, default 90 seconds) that starts when the message is queued. Custom OpenAI-compatible providers use a synchronous code path — nothing renders until the full reply is generated — so the watchdog fires before the model finishes.Tool-using turns make this worse: each tool call adds another full model round. The total time the watchdog must cover is:
With the defaults (ASSISTANT_MAX_TOOL_CALL_ITERATIONS=5, OPENAI_REQUEST_TIMEOUT=60), a worst-case turn can take up to 360 seconds of model time — far beyond the 90-second default.
The most effective approach is to lower ASSISTANT_MAX_TOOL_CALL_ITERATIONS (reducing the worst-case bound) and then size AI_RESPONSE_TIMEOUT using the formula above.For a local Ollama setup:
You can also set Chat Response Timeout from Settings → Self-Hosting → AI Provider in the UI. The environment variable takes precedence.See Chat response timeout for full sizing guidance.

​
”Add transaction” button does nothing when no account is selected

If you click Add transaction on the new transaction form without selecting an account, the button previously appeared to do nothing (the request returned a 404 error). The form now re-renders with a validation error so you can see what is missing and correct it.

​
Split transactions not grouped in account activity

When the Group split transactions preference was enabled, split child entries were collapsed under their parent on the Transactions page but still appeared as flat, ungrouped rows on the Activity tab of individual account pages. Split transaction grouping now applies consistently to both the Transactions page and the account activity feed. When the preference is on, split children appear indented under their parent row in both views.

​
Excluded transactions disappear from account activity

Transactions marked as excluded were previously hidden from the account activity feed entirely. This made it impossible to re-include them because there was no row to click. Excluded transactions now appear greyed-out in the account activity list so you can still open them and toggle exclusion off if needed.

​
Rule category, merchant, or tag names missing in exports

When you export your data (via Settings → Exports), rule conditions and actions that reference a category, merchant, or tag should appear with the human-readable name rather than the raw UUID. In older versions, two bugs could cause the name to be missing or stale in the exported rules.csv and all.ndjson files:
  • Uppercase UUID stored in the rule — Rule operand values are stored as UUIDs. If a UUID was stored in uppercase (for example, after a direct database edit or migration), the export lookup was case-sensitive and would miss the match, leaving the raw UUID in place of the name.
  • Stale in-memory association — If a category, merchant, or tag was created or modified during the same request that triggered the export (for example, as part of an import or rule-apply job), the exporter could read a stale in-memory association and produce an outdated name or omit the value_ref entirely.
Both bugs are fixed in the current release. UUID lookups are now case-normalized before the cache lookup, and operand records are reloaded from the database at the start of each export rather than using a cached association. To resolve: Upgrade to the latest release and re-run the export. No data migration or configuration change is required. If you previously imported an export that contained raw UUIDs instead of names in rule operand fields, update those rule conditions and actions manually after upgrading.

​
Rule creation from modal fails with “must have at least one action”

When creating a rule from the rule creation modal, saving the form could fail with a validation error saying the rule must have at least one action — even though you had added one. The re-rendered form also lost any dynamically added action or condition rows.
The rule form uses dynamically generated keys to identify newly added action and condition rows before they are persisted. A previous change introduced string keys of the form new_1, new_2 for these rows. Rails strong parameters only treat integer-keyed hashes as nested attributes — it checks that the key matches /\A-?\d+\z/ — so string keys were silently dropped before the record was saved. The result was a rule with no actions, which failed validation.
The key generator now produces numeric-only keys by combining the current timestamp with a per-session sequence counter (Date.now() * 1000 + seq). This avoids collisions with the numeric indexes Rails assigns to already-persisted rows on edit forms, and ensures all dynamically added rows pass Rails’ nested-attribute check.Upgrade to the latest release to get this fix. No configuration change is required.

​
Import fails on rules with no name or deleted rejected transfers

Importing an all.ndjson export could fail with two unrelated errors:
  • Rule with "name": null — The import preflight incorrectly required a name for every rule, but the rule model allows a null name. The preflight now requires the rule’s id instead, matching what the importer actually uses.
  • RejectedTransfer referencing a deleted transaction — A rejected transfer whose original transaction was later deleted caused the import to abort with a hard error. These orphaned rows are now skipped with a warning instead of blocking the entire import.
If a previous import attempt failed for either of these reasons, retry the import after upgrading.

​
Sure import fails with unresolved merchant references from an older export

Exports produced before provider-merchant support was added did not include ProviderMerchant rows in the all.ndjson file. Importing such a file into a current version of Sure would previously fail preflight with a blocking error for every transaction whose merchant_id pointed at a provider-assigned merchant.
An unresolvable merchant_id on a transaction or recurring transaction is now a preflight warning rather than a blocking error. Sure imports the row without a merchant assigned. The confirm screen shows the number of affected records under a “merchant references not found” notice.Unnamed recurring transaction series that have neither a name nor a resolvable merchant are skipped entirely (and reported separately). Named series without a merchant import normally.
Re-export from the source instance using a current version of Sure. The exporter now includes all ProviderMerchant records referenced by the family’s transactions and recurring transactions. Importing that newer export resolves the merchant references without warnings.If the source instance is no longer available, the missing merchants are rebuilt automatically the next time Sure syncs the family’s connected accounts.

​
Sure import fails because categories or tags already exist on the destination family

When a fresh family is created, Sure seeds it with a default set of categories. Importing a Sure export from another instance into that family previously failed preflight if any exported Category, Tag, or Merchant names matched the existing defaults.
Name collisions on family-owned taxonomy records (Category, Tag, and family Merchant) are now preflight warnings rather than blocking errors. Sure reuses the existing record and updates it with the imported data. The confirm screen lists how many records were reused.
Yes. Transactions and rules that referenced the imported category or tag are remapped to the surviving (reused) record. The imported data updates that record’s fields. No manual cleanup is needed.

​
Reading auto-categorization debug logs

When auto-categorization runs, Sure writes structured entries to the debug log under the auto_categorization category. Go to Settings → Debug and filter by auto_categorization to see them.
Each run can produce the following entries:
  • AI categorization cache used (info) — logged when some transactions in the batch already have an AI-set category that matches their current category. Those transactions are skipped to avoid redundant API calls. The entry includes the IDs of the cached transactions.
  • AI categorization blocked by enrichment protection (info) — logged when some transactions have a locked category_id attribute that was not set by AI. Those transactions are protected from being overwritten. The entry includes the IDs of the blocked transactions.
  • AI categorization failed: no categories available (error) — logged when the family has no categories configured. Auto-categorization cannot run without categories to map against.
  • AI categorization completed (info) — logged at the end of a successful run. The entry includes the requested transaction IDs, which transactions were categorized, which were cached or blocked, and the total number of modified transactions.
Check the debug log for auto_categorization entries. Transactions may be skipped because:
  • They already have an AI-assigned category that matches the current value (cache hit — shown in the cache used entry).
  • Their category_id attribute is locked by a non-AI source (shown in the blocked entry).
  • The family has no categories set up (shown in the no categories available error entry).

​
Why is Sure not running auto-categorization and merchant detection on the same transactions again?

Sure caches AI-generated results to avoid redundant API calls and costs. Once a transaction has been processed by AI rules, it won’t be re-processed unless you explicitly reset the AI cache.
When AI rules process transactions, Sure stores:
  • Enrichment records - Which attributes were set by AI (category, merchant, etc.)
  • Attribute locks - Prevents rules from re-processing already-handled transactions
This caching ensures:
  • Transactions aren’t sent to the LLM repeatedly
  • API costs are minimized
  • Processing is faster on subsequent rule runs
To have AI rules re-process transactions, you need to reset the AI cache:
  1. Go to Settings → Rules
  2. Click the menu button (three dots)
  3. Select Reset AI cache
  4. Confirm the action
After resetting, the next time rules run (either manually or during a sync), AI will re-process all transactions.Note: This will incur API costs if using a cloud provider.The reset runs in the background. You can track its progress and see how many AI cache entries were removed in Settings → Debug, filtered by the ai_cache_reset category. Each run logs when it starts, how many entries were removed per scope, and any records that could not be cleared.
Common scenarios for resetting the cache:
  • Switching LLM models - Different models may produce better categorizations
  • After system updates - New versions may have improved prompts
  • Fixing miscategorizations - When AI made systematic errors
  • Testing - During development or evaluation of AI features
The AI cache is automatically cleared when you change the OpenAI model setting.
The reset runs as a background job. You can confirm it completed — and see a breakdown of how many AI cache entries were removed — in the debug log:
  1. Go to Settings → Debug
  2. Filter by category ai_cache_reset
You will see:
  • An info entry when the reset is enqueued from the rules page
  • An info entry when the job starts on a worker
  • A completion entry with the number of enrichments deleted, broken down by scope
  • warn entries for any individual records that could not be cleared
  • An error entry if the job could not be enqueued at all
If you see the enqueue entry but no start entry, the job never reached a worker — check that your worker container is running.