Trading Boy is designed around email-verified dashboard sessions, scoped CLI API keys, paper-trading workflows, and operational guardrails. Security reports should go directly to the security contact path.
Single-use email links sign users into the dashboard. Full CLI API keys are shown once when created and can be revoked from authenticated settings. Support will not ask users to send full API keys, private keys, seed phrases, or exchange credentials.
Trading Boy is built for paper-trading workflows and does not hold funds or execute live exchange trades from the public website. Read exchange API key safety for paper trading before mixing paper workflows with third-party exchange tools.
Email security@tradingboy.ai with a concise description, reproduction steps, impact, and affected URL or command.
Trading Boy separates website access, API-key based product access, paper-trading records, Telegram connection state, and public benchmark display. The security posture is built around scoped access, visible AI trading agent permission boundaries, and avoiding unnecessary exposure of private trading credentials.
| Surface | Security expectation | User action |
|---|---|---|
| Dashboard sign-in | Single-use email links establish a browser session and are not CLI credentials. | Request a fresh link and consume it in the same browser session; do not forward it. |
| CLI API keys | Revocable API keys authenticate terminal and hosted API calls and must be treated as private secrets. | Create and revoke keys from authenticated settings, store them safely, and never use them as dashboard login credentials. |
| CLI workflows | Commands should authenticate through scoped Trading Boy access, not shared exchange credentials. | Use help output and remove secrets before sending logs to support. |
| Exchange API keys | Paper trading should not require live order, transfer, withdrawal, margin, or futures permissions. | Use the exchange API key safety guide before connecting any external exchange tool. |
| Trading API key checklist | API key values should stay out of prompts, screenshots, logs, and support messages. | Run the trading API key safety checklist before using a separate external tool. |
| AI agent permissions | Paper agents can review, log, and alert, but should not route live orders or control funds. | Use AI trading agent permission boundaries with human review. |
| Paper-trading records | Journal rows should keep useful simulated decision fields without leaking private identifiers. | Clean records with the paper trading data privacy checklist before sharing. |
| Telegram alerts | Alerts are workflow notifications and review prompts, not buy or sell signals. | Keep Telegram account access secure and report suspicious bot behavior. |
| Public leaderboard | Public rows should use opted-in aliases and simulated paper metrics only. | Do not publish private identifiers in public aliases. |
Useful vulnerability reports include the affected page or command, exact steps, expected and actual behavior, potential impact, and whether the issue exposes private account data, authentication state, or paper-trading records.
Trading Boy cannot recover wallet seed phrases, exchange passwords, private keys, or third-party account access. Do not send them to support or security contacts.
Read Privacy for data-handling context, Paper Trading Data Privacy Checklist before sharing journal evidence, Trading API Key Safety Checklist before using any external key, AI Agent Permission Boundaries before agent review, and Paper Trading Limitations for the simulated workflow boundary.