Security

Use API keys scoped to trading + read only — never enable withdrawals. Keys are stored encrypted. Rotate keys if you suspect exposure. The platform never displays your secret key after entry.

Enable two-factor authentication on your exchange and on your BiTi account.

• API-key scoping: trading + read only, withdrawal permission disabled.
• Encrypted key storage; secret is never re-displayed after entry.
• Two-factor authentication on the exchange and on the BiTi account.
• Network isolation: admin/actuator surfaces are access-controlled and are not exposed unauthenticated.
• Role-based access control (RBAC): control actions are role-gated; monitor surfaces are read-only.
• Audit logging: trading toggles and control actions are recorded.

Live execution is futures-first: Bybit USDT-perpetuals only. Spot, margin, and other-exchange (e.g. Binance) surfaces are research / read-only market-data and context views — they are not live execution unless a future product plan explicitly enables them.

Auto-trading is not set-and-forget: monitoring is required.

The /status page probes the frontend /api/health proxy, which calls the platform liveness/readiness endpoints. It reports OK / DEGRADED / DOWN with an explicit reason and the last-healthy timestamp — it never shows a naked “Unknown”. An Unknown-with-reason almost always indicates a stale build or a backend-unreachable deploy, not a trading fault.