oskar-j/visualize-my-expenses

Review signals: 125 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 125 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Render a Sankey PNG from a month of budget rows: Real input produced the expected result: ✓ claim-render.png

  Source: Turn a month of budget rows into a Sankey diagram you can share as a PNG.

  Input: budget.csv with -c PLN -o claim-render.png

  Expected: PNG written and reported

  Command: <guest-path> render budget.csv -c PLN -o claim-render.png

  Observed: ✓ claim-render.png income 11 250 zł spent 7 634 zł left over 3 616 zł 24 rows findfont: Failed to find font weight medium for DejaVu Sans, now using 400. findfont: Failed to find font weight semibold for DejaVu Sans, now using 700.

• A missing rate fails and the error says what to add: Real input produced the expected result: Give a rate for each one

  Source: Forget a rate and the error tells you what to add:

  Input: trip.csv with EUR rows and no --rate

  Expected: exit 2 with a Give a rate hint

  Command: <guest-path> render trip.csv -c PLN -o norate-claim.png

  Observed: Give a rate for each one, for example: --rate EUR=4.30 (one EUR is worth 4.30 PLN)

• vme formats prints the list of input formats: Real input produced the expected result: Input formats

  Source: `vme formats` prints the same list.

  Input: formats

  Expected: Input formats heading

  Command: <guest-path> formats

  Observed: Input formats camt .camt, .xml ISO 20022 camt.052/053/054 bank statements (SEPA XML) csv .csv, .tsv, .txt Comma/semicolon/tab separated values with a header row excel .xlsx, .xlsm Excel workbook (.xlsx), first sheet unless --sheet is given (needs openpyxl) json .json JSON array of rows, or {"expenses": [...]} jsonl .jsonl, .ndjson JSON Lines / newline-delimited JSON ofx .ofx, .qfx OFX / QFX bank & card statements (Quicken, Money, most US banks) qif .qif QIF (Quicken Interchange Format) exports Output: .p

• vme currencies lists the known currencies: Real input produced the expected result: AED

  Source: `vme currencies` lists them.

  Input: currencies

  Expected: list including AED

  Command: <guest-path> currencies

  Observed: AED د.إ UAE dirham 1,234.50 د.إ ARS AR$ Argentine peso AR$1 234,50 AUD A$ Australian dollar A$1,234.50 BGN лв Bulgarian lev 1 234,50 лв BRL R$ Brazilian real R$1 234,50 BTC ₿ Bitcoin ₿1 234.50000000 CAD CA$ Canadian dollar CA$1,234.50 CHF CHF Swiss franc 1'234.50 CHF CLP CLP$ Chilean peso CLP$1 235 CNY ¥ Chinese yuan ¥1,234.50 COP COL$ Colombian peso COL$1 235 CZK Kč Czech koruna 1 234,50 Kč DKK kr Dani

Examples

• Write an example file to start from: command completed successfully

  Source: README.md ## Try it in 30 seconds

  Input: <guest-path>

  Expected: CSV header written

  Command: <guest-path> sample <guest-path>

  Observed: ing,48.00,PLN,expense 2026-08-07,Eating out,Lunches,486.30,PLN,expense 2026-08-16,Eating out,Coffee,142.60,PLN,expense 2026-08-09,Health,Pharmacy,178.90,PLN,expense 2026-08-20,Health,Dentist,450.00,PLN,expense 2026-08-08,Subscriptions,Spotify,23.99,PLN,expense 2026-08-08,Subscriptions,Netflix,43.00,PLN,expense 2026-08-10,Subscriptions,Gym,159.00,PLN,expense 2026-08-13,Leisure,Cinema,68.00,PLN,expense 2026-08-24,Leisure,Books,127.40,PLN,expense 2026-08-28,Leisure,Concert tickets,240.00,PLN,expense 2026-08-15,Family,Kids' school trip,300.00,PLN,expense 2026-08-27,Family,Gifts,185.00,PLN,expense

• Multi-currency render with a rate: command completed successfully

  Source: README.md ## Multiple currencies

  Input: trip.csv --rate EUR=4.30

  Expected: PNG written

  Command: <guest-path> render trip.csv -c PLN --rate EUR=4.30 -o example-trip.png

  Observed: ✓ example-trip.png income 9 800 zł spent 3 415 zł left over 6 385 zł 3 rows findfont: Failed to find font weight medium for DejaVu Sans, now using 400. findfont: Failed to find font weight semibold for DejaVu Sans, now using 700.

• Development test suite: command completed successfully

  Source: README.md ## Development

  Input: repository tests

  Expected: all tests pass

  Command: <guest-path> -q

  Observed: ........................................................................ [ 19%] ........................................................................ [ 39%] ........................................................................ [ 59%] ........................................................................ [ 79%] ........................................................................ [ 99%] . [100%]

Local or hosted: local

Install vme-py and turn a month of budget rows into a Sankey PNG with the vme CLI (vme sample, vme render, vme summary, vme check, vme formats, vme currencies), plus the repo's pytest suite.

cd <guest-path> && git init -q 2>/dev/null; git remote add origin https://github.com/oskar-j/visualize-my-expenses 2>/dev/null; git fetch --depth 1 origin 56046c530614262069a88cce3d06379713315df5 && git reset --mixed FETCH_HEAD; ls -la; cat README.md; id -u; python3 --version
cd <guest-path> && ls .coldpass; python3 -m venv <guest-path> 2>&1 | tail -3; <guest-path> install -q vme-py 2>&1 | tail -5; <guest-path> --help 2>&1 | head -20
mkdir -p <guest-path> && cd <guest-path> && V=<guest-path>; $V --version; $V sample budget.csv && cat budget.csv && $V render budget.csv -c PLN -o august.png && file august.png && $V summary budget.csv | head -20; $V check budget.csv; echo rc=$?
cd <guest-path> && V=<guest-path>; $V check budget.csv -c PLN; echo rc=$?; $V summary budget.csv -c PLN 2>/dev/null | head -12; echo rc=$?; $V render budget.csv -c PLN -o august.png 2>&1 | tail -1; $V render budget.csv -c PLN -o august.png --month 2026-08 2>&1|tail -1; ls -la
mkdir -p <guest-path> && cd <guest-path> && V=<guest-path>; $V formats 2>&1 | head -5; $V currencies 2>&1 | head -3; printf 'date,category,label,amount,currency,kind\n2026-08-02,Housing,Rent,3200.00,PLN,expense\n2026-08-04,Food,Lunch,50.00,EUR,expense\n2026-08-05,Income,Salary,9800.00,PLN,income\n' > trip.csv; $V render trip.csv -c PLN -o <guest-path> 2>&1 | tail -2; $V render trip.csv -c PLN --rate EUR=4.30 -o <guest-path> --open=false 2>&1 | tail -2; $V render trip.csv -c PLN --rate EUR=4.30 -o <guest-path> 2>&1|tail -1; $V summary trip.csv -c PLN --rate EUR=4.30 2>&1 | tail -4
cd <guest-path> && V=<guest-path>; ls -la <guest-path>; $V render trip.csv -c PLN --rate EUR=4.30 -o trip-probe.png; echo rc=$?; $V render trip.csv -c PLN -o nope.png >/dev/null 2>&1; echo rc_norate=$?; $V formats | head -1; $V currencies | head -1; $V sample <guest-path>; echo rc=$?; head -2 <guest-path>; $V render budget.csv -c PLN -o august-claim.png; echo rc=$?; ls <guest-path>
cd <guest-path> && rm -f fresh/trip.png fresh/sample.csv out/august-claim.png out/trip-probe.png out/august.png; ls -R fresh out; cd workspace; grep -rniE "schedule|cron|--once|--now|webhook|while True|watch" src pyproject.toml | head; ls src/vme; <guest-path> install -q "<guest-path>" pytest 2>&1 | tail -3; ls -a <guest-path> | head -30
cd <guest-path> && <guest-path> -q 2>&1 | tail -8; echo rc=$?; <guest-path> show vme-py | head -2; <guest-path> install -q vme-py 2>&1|tail -2; <guest-path> -V
mkdir -p <guest-path> && cd <guest-path> && V=<guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","sample","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_file":"<guest-path>","expected_text":"date,category,label,amount,currency,kind"}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"Render a Sankey PNG from a month of budget rows","source":"Turn a month of budget rows into a Sankey diagram you can share as a PNG.","input":"budget.csv with -c PLN -o claim-render.png","expected":"PNG written and reported","probe_kind":"cli","argv":["<guest-path>","render","budget.csv","-c","PLN","-o","claim-render.png"],"output_directory":"<guest-path>","expected_text":"✓ claim-render.png","cwd":"<guest-path>"},
{"kind":"claim","claim":"A missing rate fails and the error says what to add","source":"Forget a rate and the error tells you what to add:","input":"trip.csv with EUR rows and no --rate","expected":"exit 2 with a Give a rate hint","probe_kind":"cli","argv":["<guest-path>","render","trip.csv","-c","PLN","-o","norate-claim.png"],"output_directory":"<guest-path>","expected_returncode":2,"expected_text":"Give a rate for each one","cwd":"<guest-path>"},
{"kind":"claim","claim":"vme formats prints the list of input formats","source":"`vme formats` prints the same list.","input":"formats","expected":"Input formats heading","probe_kind":"cli","argv":["<guest-path>","formats"],"expected_text":"Input formats","cwd":"<guest-path>"},
{"kind":"claim","claim":"vme currencies lists the known currencies","source":"`vme currencies` lists them.","input":"currencies","expected":"list including AED","probe_kind":"cli","argv":["<guest-path>","currencies"],"expected_text":"AED","cwd":"<guest-path>"}
]
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Write an example file to start from","source":"README.md ## Try it in 30 seconds","input":"<guest-path>","expected":"CSV header written","argv":["<guest-path>","sample","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_file":"<guest-path>","expected_text":"date,category,label,amount,currency,kind"},
{"kind":"example","claim":"Multi-currency render with a rate","source":"README.md ## Multiple currencies","input":"trip.csv --rate EUR=4.30","expected":"PNG written","argv":["<guest-path>","render","trip.csv","-c","PLN","--rate","EUR=4.30","-o","example-trip.png"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"✓ example-trip.png"},
{"kind":"example","claim":"Development test suite","source":"README.md ## Development","input":"repository tests","expected":"all tests pass","argv":["<guest-path>","-q"],"cwd":"<guest-path>"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (src/vme/cli.py and README). No cron, scheduler, loop, --once/--now, or webhook code found; vme is a one-shot CLI that runs once per invocation, so no product cycle to replay.","checks":[]}
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install vme-py and turn a month of budget rows into a Sankey PNG with the vme CLI (vme sample, vme render, vme summary, vme check, vme formats, vme currencies), plus the repo's pytest suite.","operation_scope":"Linux guest (Ubuntu, Python 3.12.3, README requires 3.9+), venv at <guest-path>, core install only (no optional excel/html extras), no network rate lookups, no browser needed.","steps":["git init; git remote add origin https://github.com/oskar-j/visualize-my-expenses; git fetch --depth 1 origin 56046c530614262069a88cce3d06379713315df5; git reset --mixed FETCH_HEAD","python3 -m venv <guest-path> && <guest-path> install vme-py (README: pip install vme-py)","vme sample budget.csv (README: Try it in 30 seconds)","vme render budget.csv -c PLN -o august.png (README quickstart; produced 1600x1536 PNG)","vme summary budget.csv -c PLN; vme check budget.csv -c PLN; vme formats; vme currencies","vme render trip.csv -c PLN --rate EUR=4.30 (README: Multiple currencies)","vme render trip.csv -c PLN with no rate -> exit 2 with 'Give a rate for each one' hint (README: Forget a rate)","pytest -q in the repo (README: Development) after pip install of the checkout with [all] extras"],"deviations":["Used a venv at <guest-path> instead of uv sync (uv not required for the pip path the README also documents).","Ran the test suite by installing the checkout (<guest-path> plus pytest) into the venv instead of uv run pytest; this replaced the PyPI vme-py with the same version 0.1.3 and was then reinstalled from PyPI for the checked probes.","First 'vme check' and 'vme summary' runs without -c failed because the default report currency is USD while the rows are PLN; this is product behaviour (error message tells you to add a rate), not a setup failure. Re-ran with -c PLN, which passed.","One of my own commands passed an invalid '--open=false' flag, which vme rejected; re-ran without it. Not a product issue.","Font warnings (findfont: DejaVu Sans weights) on stderr are cosmetic matplotlib messages; PNG output was still produced."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c 'import json;json.load(open("report.json"));print("ok")' 2>&1; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay ><guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path> | head -1; grep -o '"status": "[A-Z]*"' <guest-path> | head -1