Security at EdgeLabHub

Your journal, strategies and broker connections are sensitive. This page describes how we protect them, and what you can do to help.

• Passwords are stored only as salted hashes, never in plain text.
• You can sign in with Google instead of a password.
• Sessions use secure, HTTP-only cookies that scripts on a page cannot read, and requests are rate limited to slow guessing and abuse.
• Everything you create is visible only to your account. Other members, and unauthenticated visitors, cannot read it.

• Credentials are checked with the broker, then stored encrypted. They are decrypted only on our servers and only to call the broker for something you asked for.
• They are never displayed again or sent back to your browser.
• Orders are sent only after you read them back and confirm, and the server refuses an order without that confirmation, refuses to sell more than you hold, and enforces a limit on the size of a single order.
• Every order sent from EdgeLabHub, and the broker's reply, is logged on your account.

Angel One needs your PIN and TOTP secret so that EdgeLabHub can sign in for you. They are stored encrypted like the rest. If you would rather not, connect a different broker or use EdgeLabHub without an Angel One link. Disconnecting any broker deletes its stored credentials.

• Traffic is encrypted in transit.
• Secrets such as the encryption key are kept in configuration, not in the code.
• Documentation and diagnostic endpoints are restricted to administrators.
• Strategy scripts run in an isolated sandbox with no network access.

• Use a long, unique password, or sign in with Google.
• Where a broker lets you, use keys that allow only what you need, and revoke them in the broker if you stop using EdgeLabHub.
• Check the confirmation step on every order before you press the final button.
• Keep your email account secure: it is how you recover yours.

If you find a security problem, please tell us privately before sharing it publicly, and give us a reasonable time to fix it. Send the details, and how to reproduce it, to edgelabhub@gmail.com. Please do not access other people's data or disrupt the service while testing.

Last updated October 2026.