> Let's just say it is hard to trust a piece of software with my financial data after this. Definitely don't upload your real financial data to the shared host

> Let's just say it is hard to trust a piece of software with my financial data after this. Definitely don't upload your real financial data to the shared hosted demo. I definitely wouldn't trust the demo with real data. ... but for the actual app, you run it locally on a server you control. You can add whatever form of auth in front of it, whether that's nginx basic auth, or requiring a client certificate, or so on. The app's designed with that in mind, with the user being a trusted person, so of course it's fine for it to dump sqlstate for you to debug. Since this is AGPL free software, and self hosted, it's about as trustworthy as can be for putting data into it, and if you don't trust it yet, you can read the code and gain such trust.