Merge remote-tracking branch 'exfy/main' into perf/split-report-metadata

Author: adhorodyski

.github/actions/composite/isContributorPlus/action.yml

@@ -0,0 +1,33 @@
+name: Is Contributor+
+description: Check whether a GitHub user is a member of the Expensify/contributor-plus team. Sets IS_CPLUS=true when the user is a member, IS_CPLUS=false otherwise.
+
+inputs:
+  USERNAME:
+    description: The GitHub login of the user to check.
+    required: true
+  OS_BOTIFY_TOKEN:
+    description: OSBotify token. Needed to read team memberships (the default GITHUB_TOKEN lacks the read:org scope).
+    required: true
+
+outputs:
+  IS_CPLUS:
+    description: "'true' if the user is a member of Expensify/contributor-plus, 'false' otherwise."
+    value: ${{ steps.check.outputs.IS_CPLUS }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check Contributor+ membership
+      id: check
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.OS_BOTIFY_TOKEN }}
+        USERNAME: ${{ inputs.USERNAME }}
+      run: |
+        if gh api "/orgs/Expensify/teams/contributor-plus/memberships/$USERNAME" --silent; then
+          echo "::notice::✅ $USERNAME is a Contributor+ member"
+          echo "IS_CPLUS=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::notice::$USERNAME is not a Contributor+ member"
+          echo "IS_CPLUS=false" >> "$GITHUB_OUTPUT"
+        fi

.github/workflows/claude-review.yml

@@ -7,25 +7,50 @@ permissions:
 on:
   pull_request_target:
     types: [opened, ready_for_review]
+  pull_request_review:
+    types: [submitted]
 
 concurrency:
   group: claude-review-${{ github.event.pull_request.html_url }}
   cancel-in-progress: true
 
 jobs:
   validate:
+    if: github.event_name == 'pull_request_target'
     uses: ./.github/workflows/contributorValidationGate.yml
     with:
       PR_NUMBER: ${{ github.event.pull_request.number }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
       AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
 
+  checkCPlusApproval:
+    if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      IS_CPLUS: ${{ steps.check.outputs.IS_CPLUS }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+
+      - name: Check Contributor+ membership
+        id: check
+        uses: ./.github/actions/composite/isContributorPlus
+        with:
+          USERNAME: ${{ github.event.review.user.login }}
+          OS_BOTIFY_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
+
   review:
-    needs: [validate]
+    needs: [validate, checkCPlusApproval]
     if: |
-      needs.validate.outputs.IS_AUTHORIZED == 'true'
+      !cancelled()
       && github.event.pull_request.draft != true
       && !contains(github.event.pull_request.title, 'Revert')
+      && (
+        (github.event_name == 'pull_request_target' && needs.validate.outputs.IS_AUTHORIZED == 'true')
+        || (github.event_name == 'pull_request_review' && needs.checkCPlusApproval.outputs.IS_CPLUS == 'true')
+      )
     runs-on: blacksmith-2vcpu-ubuntu-2404
     env:
       PR_NUMBER: ${{ github.event.pull_request.number }}

Mobile-Expensify

@@ -111,8 +111,8 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         multiDexEnabled rootProject.ext.multiDexEnabled
-        versionCode 1009036104
-        versionName "9.3.61-4"
+        versionCode 1009036201
+        versionName "9.3.62-1"
         // Supported language variants must be declared here to avoid from being removed during the compilation.
         // This also helps us to not include unnecessary language variants in the APK.
         resConfigs "en", "es"

android/app/build.gradle

@@ -13,7 +13,7 @@ REMOVE noindex: true AND sitemap: false FROM YAML HEADER BEFORE PUBLISHING!
 
 # Set up the Expensify Card in the UK and EU
 
-The Expensify Card is available for companies in the United Kingdom and select European countries. This guide walks you through eligibility and how to set up and start using the card in GBP or EUR. 
+The Expensify Card is available for companies in the United Kingdom and select European countries. This guide walks you through eligibility and how to set up and start using the card in GBP or EUR.
 
 Workspace Admins can issue virtual Expensify Cards to members and manage spending in GBP or EUR. Physical cards will be available soon.
 
@@ -33,34 +33,27 @@ If your company hasn’t yet connected a GBP or EUR business bank account, [foll
 
 The Expensify Card can be used **anywhere Visa is accepted**.
 
-However, only companies registered in the following 20 UK and EU countries can enable the Expensify Card for their Workspace:
-
-- Belgium  
-- Denmark  
-- Estonia  
-- Finland  
-- Gibraltar  
-- Greece 
-- Ireland  
-- Latvia  
-- Liechtenstein  
-- Lithuania  
-- Luxembourg  
-- Malta  
-- Netherlands  
-- Poland  
-- Romania  
-- Slovakia  
-- Slovenia  
-- Spain  
-- Sweden  
+Companies registered in the following countries can enable the Expensify Card for their Workspaces:
+
+- Belgium
+- Denmark
+- Finland
+- Gibraltar
+- Ireland
+- Latvia
+- Lithuania
+- Luxembourg
+- Netherlands
+- Poland
+- Spain
+- Sweden
 - United Kingdom
 
 ## What are the pre-requisites to set up the Expensify Card in the UK and EU
 
-To set up the Expensify Card in the UK and EU, you must: 
+To set up the Expensify Card in the UK and EU, you must:
 
-1. Have a GBP or EUR bank account connected. To connect one, [Enable Global Reimbursement](https://help.expensify.com/articles/new-expensify/wallet-and-payments/Enable-Global-Reimbursement). 
+1. Have a GBP or EUR bank account connected. To connect one, [Enable Global Reimbursement](https://help.expensify.com/articles/new-expensify/wallet-and-payments/Enable-Global-Reimbursement).
 2. Complete the **[Know Your Customer (KYC)](https://launch-workflow.trulioo.com/68223577c5dae52a6ec9347f)** and **[Know Your Business (KYB)](https://launch-workflow.trulioo.com/681a7cc4e65d2e48f19de9c3)** forms.
 3. Share the last 90 days of statements from your connected GBP or EUR bank account with Concierge so they can assess your eligible limit
 
@@ -70,9 +63,9 @@ To set up the Expensify Card in the UK and EU, you must:
 
 1. From navigation tabs (on the left on Web, on the bottom on Mobile), choose **Workspaces > [Workspace Name] > More features**.
 2. In the **Spend** section, enable **Expensify Card**.
-3. So that we can assess your request, reach out to Concierge and provide the last 90 days of statements from the connected UK or EU bank account 
+3. So that we can assess your request, reach out to Concierge and provide the last 90 days of statements from the connected UK or EU bank account
 
-Once enabled, **Expensify Card** will appear in the navigation tabs. 
+Once enabled, **Expensify Card** will appear in the navigation tabs.
 
 ---
 
@@ -88,7 +81,7 @@ Once enabled, **Expensify Card** will appear in the navigation tabs.
 
 1. From navigation tabs (on the left on Web, on the bottom on Mobile), choose **Workspaces > [Workspace Name] > Expensify Card**
 2. Click **Issue new card**.
-3. Select the employee the card should be issued to. 
+3. Select the employee the card should be issued to.
 4. Choose **Virtual**.
 5. Pick a limit type:
    - **Smart limit** – Spend up to a threshold before needing approval
@@ -110,7 +103,7 @@ We use the [Visa FX calculator](https://www.visa.co.uk/support/consumer/travel-s
 
 ## Does the Expensify Card support Visa Secure for online transactions?
 
-Yes, the Expensify Card protects online transactions with Visa Secure. Please review the [Visa Secure FAQs]({{site.url}}/assets/Files/Visa-secure-faq-expensify.pdf) for more information. 
+Yes, the Expensify Card protects online transactions with Visa Secure. Please review the [Visa Secure FAQs]({{site.url}}/assets/Files/Visa-secure-faq-expensify.pdf) for more information.
 
 ## How do I get help with the Expensify Card in the UK and EU?
 

assets/images/simple-illustrations/simple-illustration__newuser.svg

@@ -2,14 +2,16 @@
 title: Avoiding common scams
 description: Learn how to recognize and avoid common phishing scams that pretend to be from Expensify, including fake phone calls and emails asking for your Magic Code.
 keywords: [Expensify scam, phishing, Magic Code, security, login code, avoid fraud, suspicious email, fake call, fraud prevention]
+internalScope: Audience is all Expensify members. Covers identifying and responding to scams involving Magic Codes. Does not cover account recovery or dispute workflows.
 ---
-<div id="expensify-classic" markdown="1">
 
-# How to avoid scams pretending to be from Expensify
+# Avoiding common scams
 
 Some scammers try to impersonate Expensify by sending fake emails or calling you directly, often asking for your **Magic Code** (your login code). These scams are designed to trick you into giving up access to your Expensify account.
 
-This guide explains what these scams look like, how to spot them, and what to do if you think you've been targeted.
+This article explains how these scams work, how to recognize them, and what actions to take.
+
+**Note:**  Expensify will never call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
 ---
 
@@ -21,21 +23,17 @@ The **Magic Code** is a one-time login code Expensify emails or texts to you whe
 
 ---
 
-## Common scams to watch out for
-
-Here are the most common types of scams we've seen targeting Expensify members:
-
-### 1. Phone call scams requesting your Magic Code
+## How to recognize phone call scams pretending to be Expensify
 
 - The scammer claims to be from Expensify and needs your Magic Code to verify your account.
 - They may spoof a legitimate phone number to make it seem more convincing.
 - Some scammers may create a sense of urgency (e.g., “We detected suspicious activity on your account.”)
 
-**If someone calls you asking for your Magic Code, hang up immediately.**
+**If you receive this type of call, hang up.**
 
 ---
 
-### 2. Phishing emails and texts requesting you use their link to login to Expensify
+## How to recognize phishing emails or texts pretending to be Expensify
 
 - Emails and text messages often look like they’re from Expensify or Visa, but the sender address is likely not from an expensify.com email address.
 - These emails and text messages may have links that lead to a fake login page, prompt you to reset your password, or ask you to reply with your Magic Code.
@@ -45,32 +43,46 @@ Here are the most common types of scams we've seen targeting Expensify members:
 
 ---
 
-## How to stay safe
-
-Here’s how you can protect your Expensify account:
+## How to protect your Expensify account
 
 - **Never share your Magic Code** — not over the phone, not by email, not via text.
 - **Don’t click suspicious links** — always verify the sender’s email address.
-- **Use 2FA** (two-factor authentication) to add an extra layer of security.
-- **If in doubt, message Concierge** directly from within the Expensify app.
+- **Use two-factor authentication (2FA)** - this adds an extra layer of security to your account. 
+- **If in doubt, message Concierge**  - reach out directly from within the Expensify app.
+
+[Learn how to enable two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication). 
+
+---
+
+## What to do if you receive a Magic Code you didn't request
+
+If you receive a Magic Code email but didn’t try to log in, this does not necessarily mean your account has been compromised. It can happen for a variety of reasons, such as someone mistyping an email address. 
+
+Here's what to do:
+
+1. **Do not share the code with anyone** — simply ignore or delete the email.
+2. **Do not click any links** in the email. 
+3. **Consider enabling [two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication)** for extra account security.
+
+**Note:** You do not need to lock your account just because you received an unexpected Magic Code. Only lock your account if you believe someone has gained access to your email account or if you shared your Magic Code with someone.
 
 ---
 
 ## What to do if you shared your Magic Code
 
 If you accidentally gave someone your Magic Code, act fast:
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Contact Concierge** from a safe device and explain the situation.
-3. **[Enable two-factor authentication](https://help.expensify.com/articles/expensify-classic/settings/Two-Factor-Authentication)** to protect your account going forward.
+3. **[Enable two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication)** to protect your account going forward.
 
 ---
 
 ## How to report phishing and lock your account
 
 If you believe your account has been targeted or compromised:
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Message Concierge immediately** via [email](mailto:concierge@expensify.com), or from within the Expensify app (web or mobile).
 3. Let us know if you’ve received a suspicious message or phone call.
 4. Our team will work to secure your account.
@@ -90,9 +102,12 @@ Expensify uses Magic Codes instead of passwords to simplify login while keeping
 
 Legitimate Expensify emails always come from an address ending in **@expensify.com** or **@team.expensify.com**. If you’re unsure, don’t click any links — just log into the Expensify app directly and message Concierge.
 
+## I received a Magic Code I didn't request. Is my account compromised?
+
+No. Receiving an unrequested Magic Code does not mean your account is compromised. It most likely means someone entered your email address by mistake when trying to log in. As long as you don't share the code with anyone, your account is safe. You can simply ignore or delete the email. If you want extra protection, enable [two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication).
+
 ## Can Expensify call me?
 
 Expensify will **never** call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
-</div>
 

docs/Hidden/UK-and-EU-Expensify-Card.md

@@ -19,7 +19,7 @@ Workspace Admins can reconcile Expensify Card expenses when the Expensify Card i
 
 ## How to View Expensify Card Withdrawals
 
-1. Click the navigation tabs (on the left on web, on the bottom on mobile) and go to **Reports**.
+1. Click the navigation tabs (on the left on web, on the bottom on mobile) and go to **Spend**.
 2. In the **Reconciliation** section, select **Expensify Card**.
 3. Choose the **Withdrawn** filter to select a date range (for example, **Last month**).
 4. Review the list of withdrawals. Each row represents a single settlement withdrawal from your bank account.

docs/articles/expensify-classic/settings/Avoiding-common-scams.md

@@ -123,7 +123,7 @@ Use this section to quickly check how much you can spend before making a purchas
 
 ## What is Home for?
 
-Home helps you get oriented when you sign in. It shows whether anything needs attention, highlights what’s new, and points you to the right place—like Inbox or Reports—if you need to take action.
+Home helps you get oriented when you sign in. It shows whether anything needs attention, highlights what’s new, and points you to the right place—like Inbox or Spend—if you need to take action.
 
 ## Is Home the same as Inbox?
 

docs/articles/new-expensify/expensify-card/View-and-Reconcile-Expensify-Card-Expenses.md

@@ -20,8 +20,8 @@ Anyone with an Expensify account can use the free features — no workspace requ
 
 ## Where to find free features in Expensify
 
-- **Web:** Use the navigation tabs on the left to access **Inbox**, **Reports**, or **Account**.
-- **Mobile:** Use the navigation tabs on the bottom to access **Inbox**, **Reports**, or **Account**.
+- **Web:** Use the navigation tabs on the left to access **Inbox**, **Spend**, or **Account**.
+- **Mobile:** Use the navigation tabs on the bottom to access **Inbox**, **Spend**, or **Account**.
 
 ---
 
@@ -94,7 +94,7 @@ For purchases without receipts, enter expenses by hand.
 Export your data for taxes, budgeting, or sharing with an accountant.
 
 ### Web
-1. Click **Reports** > **Expenses**.
+1. Click **Spend** > **Expenses**.
 2. Tick the boxes of the expenses you want to export. 
 3. Click **Selected** at the top.
 4. Choose **Export** from the dropdown menu.