Questions about unattended EBICS 3.0 downloads for ZKB #54

Hi, thanks for maintaining this project.

I’m helping a business download ZKB statements (camt.053 v08) and PDF bank documents over EBICS 3.0. We only need downloads, not payments. I’m evaluating the current master at 9e45631.

I’m not an EBICS expert. An AI-assisted review raised a few concerns worth checking before we run this unattended:

• Private keys saved outside the password-protected keystore — I see this is already reported in (Copy of) private key is stored unencrypted #38.
• How bank keys and incoming bank responses are verified.
• Downloads overwriting an existing file before the new data is checked.
• How to recover safely if the connection drops around the download acknowledgement.

We checked the code paths and reproduced some behaviors locally, without contacting a bank. We may still be missing context about the intended usage.

Would you be open to findings from an AI-assisted review? Happy to share more details and contribute a focused PR if useful. For the security-related details, is there a private reporting channel you’d prefer?