EigenCapital is a quantitative trading platform that handles live capital through a MetaTrader 5 broker connection. Security issues can directly result in financial loss.

The following are in scope for security reports:

• Broker connection security: MT5 bridge authentication, session management, credential handling
• Order execution safety: Unauthorized order submission, order manipulation, bypass of risk gates
• Strategy integrity: R4 signal tampering, fingerprint bypass, config drift exploitation
• Data integrity: Audit trail manipulation, evidence tampering, state corruption
• Access control: Unauthorized access to trading processes, configuration files, or credentials
• Dependency vulnerabilities: Known CVEs in dependencies that could affect the trading system

• Theoretical trading strategy weaknesses (these are research questions, not security issues)
• Documentation inaccuracies
• UI/cosmetic issues
• Issues requiring physical access to the trading machine

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, email: ameymanuel@gmail.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact (especially financial impact)
• Suggested fix (if any)

The following controls are designed to prevent the most dangerous failure modes:

• Broker credentials are NOT stored in the repository
• Use environment variables or .env files (gitignored)
• .env.example provides the template — never commit actual values
• MT5 bridge runs locally on port 8001 — not exposed to network
• Telegram webhook tokens loaded from environment variables only

Run pip audit periodically to check for known vulnerabilities in dependencies.

Key dependencies:

• mt5linux — MT5 bridge for Linux
• numpy, pandas — Research/strategy computation
• pytest, ruff, mypy — Development tooling only