🔐
Access & authentication
- The entire application (everything under
/app) is private and requires authenticated sign-in. - Identity-provider login with a mandatory time-based one-time password (TOTP) second factor.
- Sensitive, state-changing actions require a re-verified second factor.
- Role-based access control governs what each account may see and do.
🌐
Network & edge
- All traffic is served over HTTPS behind an authenticating edge proxy.
- A web application firewall, bot mitigation, and rate limiting screen requests before they reach the app.
- Strict Content-Security-Policy, HSTS transport hardening, and clickjacking protections on every response.
- Brokerage gateways run on isolated hosts, never exposed to the public internet.
🗄️
Data protection
- Broker credentials and secrets are encrypted at rest.
- Least-privilege database roles separate read-only analytics from privileged operations.
- Security-relevant events are logged for audit.
👁️
Public surface
- The pages you're reading are the only content served without sign-in.
- They expose no account, position, or trading data — none of it.
- The contact form carries no database connection and stores nothing.
Responsible disclosure
Found something that looks off? We'd genuinely like to hear from you. Report it through the contact form and it reaches us directly.