| Version | Supported |
|---|---|
| 0.1.x | Yes |
Please do not open a public issue for security problems.
- Use GitHub Private vulnerability reporting on this repository, or
- Email the maintainers (replace with your contact when publishing).
Include:
- Description and impact
- Reproduction steps / PoC (non-destructive)
- Affected version / commit
We aim to acknowledge within 72 hours and ship a fix or mitigation ASAP.
- FinAgent is self-hosted; you are responsible for network exposure (prefer Tailscale / reverse-proxy HTTPS).
- Live trading plugins can move real money — treat API keys as highly sensitive.
- The agent must never be able to enable live mode or read decrypted secrets; please report any bypass.
- Secrets: Fernet ciphertext; KEK via Argon2id; secret upsert requires password re-auth
- Passwords: Argon2id (bcrypt migrates on next login); login rate-limited and audited
- Startup fails closed on insecure default JWT/Fernet secrets unless
FINAGENT_ALLOW_INSECURE_SECRETS=1 - Wizard cannot enable live trading; live orders always need confirmation
- Kill switch on is instant (Panic Stop in header); turning kill switch off needs re-auth
- Live routing uses only
trading.default_broker(never an accidental stub) - LLM URL SSRF allowlist; webhook/Discord/Slack URLs SSRF-checked (private IPs blocked unless
FINAGENT_ALLOW_PRIVATE_WEBHOOKS=1) - Agent cannot confirm paper fills without the trading UI / cannot enable live
- Structured logs redact passwords, tokens, and secrets
- Backups export ciphertext only � restore with the same
FINAGENT_SECRET_KEY, then restart
| Risk | Mitigation |
|---|---|
| Stolen laptop DB | Secrets encrypted; protect .env / FINAGENT_SECRET_KEY |
| Malicious LLM tool call | Agent cannot go live or set confirmed; tools cannot read secrets |
| SSRF via webhook | Host allowlist + block metadata/private IPs |
| Accidental live order | Paper default; re-auth for live; confirm; Panic Stop |