Edge Scanner v1.2.0

Safer by default against web pages in your browser, a confirmed VWAP cross, and a Liquid movers universe that stops shutting out high-priced stocks.

Not financial advice. The sample setups are starting points, not a strategy.

Security: the scanner only answers this machine

The scanner already listened on localhost only. That still left a gap: a web page open in your browser could send the scanner a request. It could not read the answer, but a plain POST could reset your settings. A page using DNS rebinding (its own hostname re-pointed at your machine) could read and change everything.

• Every request must now be addressed to localhost, 127.0.0.1 or [::1]. Other names are refused before anything runs.
• Changes must come from a page this machine served, and POST requests must be JSON. Scripts that send no Origin header keep working; a script that POSTs needs Content-Type: application/json.
• The same checks cover the alert WebSocket.
• The dashboard's file route no longer accepts paths that Windows would treat as a network share.
• The update check accepts only a well-formed version tag, always links to this repo's releases page, and never prints control characters. It sends your IP and the scanner version, nothing else.
• Opening the dashboard from another machine with --host 0.0.0.0: list the names it will use in SCANNER_ALLOWED_HOSTS in .env (see .env.example). There is still no login, so only do this on a network you trust.

VWAP cross, confirmed

New trigger VWAP cross (confirmed): a completed candle closes across VWAP and the next candle closes on the same side, in the same session, with no missing candle between. Wicks and candle color do not matter; the closes do. The VWAP hold condition also gains a side option, Opposite the trade direction, so one setup can cover both directions.

Liquid movers: dollar volume only

The Liquid movers universe filter (and the build_universe.py defaults) dropped the 5M shares-a-day floor. Above the $15 price floor it did nothing except shut out high-priced stocks: a $500 stock needed $2.5B a day to clear it. The dollar-volume floor rose from $50M to $150M a day to keep the alert count reasonable.

• Setups and rankings using Liquid movers now see roughly 700 symbols instead of about 240, including large caps such as LLY, ASML, CAT, GS and COST. Expect more alerts.
• An existing install keeps its current filter: the copy under data/ is yours and is not overwritten. To adopt the new default, edit the Liquid movers filter in Config: remove the average share volume condition and set average dollar volume to 150M. New installs get it automatically.

Chart history cache keyed by bar size

Intraday chart history is now cached separately per bar size, so a 1-minute and a 5-minute download of the same symbol can no longer overwrite each other.

Update

git pull, then npm --prefix dashboard-v2 run build, then restart the scanner. Or download the zip below.