An Actual Budget sync server stores synchronization data for one or more budgets and can optionally use end-to-end encryption. A reachable server is not automatically a readable budget, but the deployment still has authentication, storage, and synchronization decisions that deserve review.
Actual's sync documentation says the server requires a password before it allows access to a budget. End-to-end encryption is an optional additional layer generated from a password. The server configuration documentation lists ACTUAL_LOGIN_METHOD and the data path used by the sync server.
A small observation
On 2026-11-01, app="Actual Budget" returned 0 ZoomEye matches and title="Actual Budget" returned 11. Both used page 1, page size 1, and sub_type=all.
The title sample is small. It may include documentation and project pages as well as live deployments, and an 11-result observation is a weak basis for a global exposure claim. The valid zero app result simply means this fingerprint did not match in this scope.
Map authentication and encryption separately
Record the public base URL, reverse proxy, TLS certificate, authentication method, and storage directory. Confirm that the password requirement is enabled for the intended deployment. Test an unauthenticated request to a budget sync route and verify that it does not return budget data.
End-to-end encryption is not a substitute for account security. It changes what the server can read when enabled, but the client and user password paths still matter. The documentation also notes that bank-sync API secrets are stored on the server and are not covered by end-to-end encryption. Review that feature separately.
Inventory clients and devices that synchronize with the server. Remove old devices and credentials when a user changes roles. Check that a reset of synchronization data is intentional and that a recent backup exists.
Verify the deployment boundary
Use a test budget and a test user. Record a successful synchronization and an unauthenticated failure. Inspect the storage path permissions and confirm that the server process cannot read unrelated files. Review the reverse proxy logs for query strings or headers that might contain credentials.
If the server is not needed outside a private network, restrict it there and verify that every DNS record resolves to the protected route. If remote synchronization is required, use TLS and a documented recovery path for the encryption password.
Treat the count as a lead
The title count is small enough that each candidate can be reviewed manually. The observation should be paired with the actual login method, storage permissions, encryption setting, and owner. It does not prove a budget can be read and should not be presented as a vulnerability count.