Security
What connecting your brokerage actually does
This site asks for something serious: a connection to the account your money is in. Here is precisely what that connection can and cannot do, how the rest of your account is protected, and which controls do not exist yet.
The brokerage connection
Your money never moves to us
There is no account here to fund and no balance to withdraw. Your capital stays in your own brokerage account for its entire life on this platform, and a strategy trading it moves positions inside that account rather than moving money out of it. We are not a broker, a custodian or a money transmitter, and nothing on this site can initiate a transfer.
We never see your broker password
Brokerage connections are established through SnapTrade, which handles the login with your institution directly. What comes back to us is an authorisation reference, not a credential. There is no field anywhere in this product that asks for a brokerage username or password, and if you are ever shown one, it is not us.
Read-only unless you deliberately choose otherwise
A connection is opened read-only by default. Trading permission is a separate, explicit choice made when you want a strategy to place orders, and the code that decides whether a connection may trade fails closed: a connection whose type cannot be read is treated as read-only rather than assumed capable, because the failure that matters is the one that offers auto-execution on a connection that turns out not to have it.
You can revoke without asking us
The connection lives at your broker as much as it does here. You can disconnect it from your account page, and you can independently revoke it at your brokerage, which works whether or not this site is reachable or cooperative at the time. Auto-execution stops the moment either one happens.
Your account here
Separate from the broker connection, and worth stating specifically rather than as a claim to take “security seriously”.
- Passwords
- Hashed with scrypt and a random 16-byte salt generated per user, and compared in constant time. The plaintext is never written anywhere, and nobody here can read it or recover it for you.
- Sessions
- A 256-bit random token in a cookie that is HttpOnly, SameSite=Lax, Secure in production, and expiring. HttpOnly means page scripts cannot read it. You can see every active session and sign the others out from your account settings.
- Strategy API keys and signal URLs
- Stored only as SHA-256 hashes. The key is shown once, when it is created, and cannot be retrieved afterwards by us or by you: if it is lost or exposed, rotate it, which invalidates the old one immediately.
- Cross-site requests
- Every cookie-authenticated write has to declare an Origin belonging to this site, so a form on someone else's page cannot act as you even with your cookie attached.
- Browser policy
- A content security policy restricts scripts, styles, images and connections to this origin, forbids this site being framed at all, and upgrades insecure requests. Framing is how a convincing copy of a page harvests what you type into it.
What limits a strategy
Trading permission is not unlimited permission. When you let a strategy trade for you, it is bound by the amount you allocate to it, a cap on any single order, an expiry on orders that cannot be filled promptly, and a price guard that skips a trade when the market has already moved against it. You set those before anything trades and can change or stop them at any time. The full mechanism, including what happens when a broker connection drops mid-session, is on the methodology page.
Not yet in place
This is a beta run by a small team, and the honest version of a security page includes the gaps.
- Two-factor authentication. Not built yet; it is the next thing on this list.
- An independent third-party security audit or penetration test. Not done yet, and we will say so here when it is rather than implying it now.
- A formal bug bounty. Reports are still welcome and still get answered, they are just not paid.
Reporting something
If you find a vulnerability, email ysaead@truefills.com with enough detail to reproduce it. You will get a human reply. Please give us a reasonable window to fix it before publishing, do not access, alter or retain data belonging to anyone else while testing, and do not run anything that degrades the service for other people. Good-faith research reported this way is welcome and we will not pursue you for it.
If you believe a published record has been altered, you do not need us to check: the file and the algorithm are both public, so recompute the chain yourself and send us the mismatching sequence number.
Trading involves risk of loss, and no security control changes that. Past performance, live or simulated, does not guarantee future results.