Security Overview
This page describes the intended operational security model. Customer access and live trading remain unavailable during the current preview and forward-testing stage.
Credential boundaries
The application is designed to encrypt stored exchange credentials and reject withdrawal-enabled keys. Credentials are not entered anywhere on this static website.
Execution boundaries
Mock, testnet, and live environments use separate configuration. Live execution requires independent activation controls and remains disabled during testnet certification.
Position and order safety
The trading application is designed to reconcile local state with exchange state, verify accepted fills, use reduce-only exits where appropriate, and stop when required state cannot be confirmed.
Operational safeguards
The production plan includes encrypted secrets, least-privilege access, TLS, secure cookies, CSRF protection, authentication rate limits, restricted diagnostics, worker health checks, database backups, audit records, and monitored infrastructure.
User responsibilities
Users of any future release should use unique passwords, enable multi-factor authentication, restrict API keys by IP where supported, disable withdrawals, and revoke keys immediately after suspected exposure.
Responsible reporting
A private security contact and coordinated reporting process will be published before public customer onboarding. Never post credentials or vulnerability details publicly.