v0.2.4 — Choose your own password on first login

🔑 v0.2.4 — Choose your own password on first login

What's new

• First login sets your own password. The key the desk ships with only works once:

  • the EC2 instance ID on AWS
  • the password docker/up.sh prints on Docker installs

  It opens a screen where you choose your own password, typed twice. The dashboard and API stay locked until you do.

• Step-by-step first login on AWS. The login page shows an Open my AWS instances button for your server's region, where to copy the Instance ID, and a picture of the column to look for. Stray spaces and capital letters in the ID are ignored.

• Passwords are hashed. Your password is stored with bcrypt, never as plain text. An existing plain-text password is converted automatically when you upgrade.

• Stay logged in. A browser stays signed in for about a year. Logging out ends that browser, and changing your password signs out every other browser.

• Changing your password asks for the current one.

• Going live asks for your password. Switching the desk to real money (live mode) requires typing your password again, even in a browser that's already logged in.

• No more password-less desks. Every desk has a password now. On a hand-built install with no MASTER_PASSWORD, the password can only be set from the same machine or your local network, and never through a proxy or from inside a container.

Upgrading

git pull
docker compose pull && docker compose up -d   # migrations run automatically

Hosted (AMI) installs: set SHOEMONEYX_VERSION=0.2.4 in .env, then run the same two commands.

Check these after upgrading:

• Still on the original key (instance ID, or the password up.sh printed): your next login takes you to the choose-a-password screen.
• Year-long login: older installs have SESSION_LIFETIME=120 in .env, which logs you out after 2 idle hours. Change it to SESSION_LIFETIME=525600, or delete the line, then run docker compose up -d.
• Scripts that send X-Desk-Token: switch them to your new password once you've set it. The original key stops working for API calls.
• Desks that ran with no password: you'll be asked to set one. Set MASTER_PASSWORD in .env first if the desk is reachable through a proxy.

v0.2.3 — Security hardening from a full audit

🛡️ v0.2.3 — security hardening from a full audit

After the v0.2.2 fix we audited the whole codebase: auth, secrets, injection, the live order path, and infrastructure. Every fix below shipped with tests and a CodeRabbit review. The live-order changes also had two independent reviews, with mutation testing to prove the new tests catch the bugs they target.

⚠️ Behaviour changes to know about

• Strategy plugins are now capped by the desk's risk limits. JSON plugin sizing (usd, formula, pct_equity, kelly) can no longer exceed size.kelly_cap_pct of equity (default 6%). Plugin leverage is capped at the new size.max_leverage (default 3x). If your plugin sized bigger on purpose, raise those settings deliberately.
• Self-signed installs get a new TLS certificate. The key used to be baked into the public image, so every install shared it. It's now generated per install on first start, so expect one new browser certificate warning.
• Risk settings are range-checked. For example, size.kelly_cap_pct must be in (0, 1] and size.max_open_positions must be a whole number ≥ 1.

💸 Live order safety

• Idempotent live orders. Every live order is recorded before it's sent, with a stable client order id. A timeout or failed readback is now unknown, not rejected, and gets reconciled against the exchange instead of being re-sent. This closes paths that could send a duplicate live order.
• Stuck-order handling.
  • A spot stop-loss can still fire while an entry order is unresolved.
  • A blocked perps exit alerts immediately.
  • php artisan desk:intents:resolve lets an operator settle a stuck order, but only after checking with the exchange.
• One cycle at a time. Concurrent desk cycles can no longer double an entry, and a cycle time budget stops new entries when a cycle runs long.

🔐 Access control

• Failed X-Desk-Token and login attempts are throttled per IP.
• With no master password set, cross-site writes are refused. If DESK_REQUIRE_MASTER_PASSWORD is on but no password exists, the desk fails closed until one is set.
• Optimizer and backtest websocket events moved to a private channel that requires a login.
• The AI strategy agent can no longer publish, import, or register on the hub by itself. Those actions now ask you to confirm. Community text in tool results is marked as untrusted input.

🧱 Hardening

• Blocks SSRF on the WorldMonitor URL: link-local and cloud metadata addresses, IPv4 and IPv6, redirects.
• Formula length and depth limits, and a 64KB cap on strategy definitions.
• Hub slug and version validation.
• The Telegram token is redacted from logs.
• Coinbase API logs are pruned after 7 days.
• nginx security headers.
• .dockerignore tightened.
• CI tokens are least-privilege, and :latest is published only for stable tags.
• .env.example defaults to production with debug off.

Upgrading

git pull
docker compose pull && docker compose up -d   # migrations run automatically

Hosted (AMI) installs: set SHOEMONEYX_VERSION=0.2.3 in .env, then run the same two commands.

If you skipped v0.2.2, read its notes: rotate your master password.

v0.2.2 — Security fix: master password never reaches the browser

🔐 Security fix: upgrade and rotate your master password

v0.2.1 and earlier handed the desk's master password to the browser: it was written into every page's HTML and into localStorage, logout didn't clear it, the API accepted it as a ?token= query parameter, and it worked as a permanent API token. GET /api/settings also returned it.

If you ran v0.2.1 or earlier with a master password set, change it after upgrading. The upgrade stops new leaks; it can't take back a password that was already exposed (saved page source, a browser extension, a shared browser, proxy logs).

What changed

• 🍪 The browser authenticates to the API with its httpOnly login session cookie. The password never reaches the page. Writes also need the session's CSRF token.
• 🚪 Logout ends API access. Sessions expire when idle, and the app clears any desk_token older versions left in localStorage.
• 🔄 Changing the password signs out every other browser.
• 🚫 ?token= is gone. Scripts keep working with the X-Desk-Token header.
• 🙈 /api/settings no longer returns the master password and can't change, clear, shadow or alias it (MASTER_PASSWORD, master_password.x and friends are refused, and any such rows left by older versions are purged on upgrade). Change it from the onboarding wizard.

Upgrading

git pull
docker compose pull && docker compose up -d   # migrations run automatically on start

Hosted (AMI) installs pin the image: set SHOEMONEYX_VERSION=0.2.2 in .env, then run the same two commands.

After upgrading, open the desk, log in, and change your master password from the onboarding wizard.

Also in this release: the strategy builder's intent lint and dependency updates merged since v0.2.1.

Thanks to Chuck Price, who reported this privately under SECURITY.md. 🙏

v0.2.1 — Full walkthrough video

🎥 The full walkthrough is here

A 15 minute tour of every feature in SMX, start to finish, explained like you're five.

▶ Watch it on YouTube · or download the 1080p mp4 (124 MB) with subtitles attached below.

It covers the three ways to install it, the first-run wizard, why a paper desk still needs an
exchange key, the charts and sub-minute candles, the desk cycle, backtests, the walk-forward
optimizer, the arena, and a deep dive on building a strategy: filters, indicators, oscillators,
entry sizing, the take-profit ladder, the π re-entry loop, and the stop that re-anchors on
every add.

Chapters

0:13	Why I built this, and the honest warning
1:29	Three ways to run it
2:49	First-run setup wizard
3:16	Why a paper desk still needs an exchange
5:05	Charts and sub-minute candles
6:05	The desk: scan, vet, size, fills
7:14	Backtests and why fees matter
7:52	Optimizer and walk-forward
9:21	Strategy builder
11:53	Take profit, the ladder and the runner
12:44	π re-entry
13:47	The stop that re-anchors
14:40	The built-in AI assistant

Also in this release

• Font Awesome Pro is gone. The whole icon set is the free one, and FA_PRO_KEY is no longer
  needed to build. A clean clone now installs with no private registry and no secret.
• Ten starter strategy templates, all validated against the v2 schema.

Read this first

This is an early open source release of a system that was private for seven years. If you plan to
trade real money, consider waiting a few versions. Paper trade all you like, and please open issues
for anything you break.

Not financial advice. Simulate it, look at the numbers, decide for yourself.