Skip to content

SAFETY.md

Latest commit

 

History

History
54 lines (40 loc) · 2.32 KB

SAFETY.md

File metadata and controls

54 lines (40 loc) · 2.32 KB
Raw

Safety architecture

Non-goals

This CLI does not place, modify, close, cancel, copy, or route a live trade. It does not store broker credentials, infer a trading decision, or bypass product confirmation and risk controls. Those are intentional product boundaries, not missing CLI features.

Network policy

  • mock binds only to localhost or 127.0.0.0/8.
  • doctor defaults to http://127.0.0.1:8788.
  • tail requires an explicit loopback base URL and never accepts an API key.
  • local HTTP is accepted; non-loopback endpoints require HTTPS.
  • URLs with user info, paths, query strings, or fragments are rejected.
  • Redirects are not followed, so scoped read keys cannot cross origins.
  • public remote diagnostics use only documented /api/v1 GET endpoints.
  • the undocumented synthetic SSE route is reachable only on the local mock.

Secret policy

API keys and webhook secrets are accepted by environment-variable name. The values are never included in normal output. Structured output recursively redacts sensitive field names and known PipSync/Bearer token shapes. Network errors show a URL without credentials, query, or fragment.

Do not pass secrets through file names, URLs, query strings, command-line arguments, fixture JSON, or source control. Use a scoped read key for diagnostics.

Payload policy

validate and local mock ingest accept paper or sandbox mode only. Signal and event validators are intentionally conservative and are not the canonical production schema. Inputs, responses, and SSE lines are size-bounded.

Webhook policy

Webhook verification uses exact raw bytes, a five-minute default timestamp window, HMAC-SHA256, and constant-time digest comparison. Exactly one timestamp and one or more v1 signatures are required. Multiple v1 values support key rotation; unrelated extension fields are ignored, as in the public SDK. Verification itself creates no receipt, replay claim, or side effect.

Extension checklist

Before merging a new command:

  1. Show why a read-only or local paper command is insufficient.
  2. Keep a closed allowlist of methods and endpoints.
  3. Add tests proving no secret appears in output or errors.
  4. Bound every input and long-running stream.
  5. Add negative tests for non-loopback, remote HTTP, malformed input, and live mode.
  6. Preserve the absence of live execution commands.