Security
The keys to your account are the most valuable thing you hand us. So we are plain about security: what is already done, and what is still ahead.
What is already done
Keys without withdrawal rights
We accept trade-only keys. A key that can withdraw funds is refused: the rights are checked when you connect.
IP allowlist
A key can be limited to the addresses our executor works from. A stolen key is then useless anywhere else.
No secrets in the repository
Keys and passwords are not kept in the code and do not reach logs or reports. The repository holds example settings files only.
Isolated executor
The part that talks to the exchange is separated from the part that receives webhooks: the receiver has no direct access to the keys.
Sender checks
A webhook is checked against the secret and the sender address, and repeats within a minute are dropped. A foreign message never reaches money.
The venue's answer in the journal
Everything sent to the exchange and everything it answered lands in the signal journal. You can audit what the service did yourself.
What is still ahead
An external security audit before the service works with real money. For now the work runs on the exchange's test environments. We would rather say this plainly than draw certificate badges.
Found a vulnerability
Write to us before going public with it. The reporting address and the responsible disclosure process will appear here.