OptionsLabOptionsLab

Security

Security at OptionsLab

OptionsLab routes live orders and holds broker connectivity details. We treat security as a first-class engineering requirement — not a checkbox. This page describes what we do and what you should know about operating OptionsLab securely.

Authentication & sessions

  • JWT-based authentication with short-lived access tokens and refresh rotation.
  • Passwords hashed with bcrypt (work factor 12). Plaintext passwords are never stored or logged.
  • Admin impersonation creates an auditable session separate from the admin's own token.
  • All auth events (login, logout, password reset) are written to a structured audit log.

Data protection

  • Broker credentials (IB account details) are stored encrypted at rest using AES-256-GCM.
  • Webhook secrets are hashed — the raw secret is never retrievable after creation.
  • TimescaleDB data is isolated per-account. Queries are parameterised to prevent SQL injection.
  • LLM agent memory is scoped to each agent and tenant — no cross-contamination.

Network & infrastructure

  • All public endpoints are served over TLS 1.2+ enforced by Caddy.
  • Internal services (database, NATS, bot) communicate on a private Docker network — never exposed to the public internet.
  • IB API connections are made from the bot container to TWS / IB Gateway over the local network — no broker credentials traverse the public internet.
  • Rate limiting is applied on all webhook and REST endpoints to prevent abuse.

Self-hosting model

  • OptionsLab is designed for self-hosting. You control your data, your infrastructure, and your broker connection.
  • No telemetry or usage data is sent to OptionsLab servers by default.
  • Docker images are built from pinned base images and scanned for known CVEs in CI.
  • Dependency updates are reviewed and tested before release, including Python and npm packages.

Responsible disclosure

If you discover a security vulnerability in OptionsLab, please report it privately before disclosing publicly. We commit to acknowledging reports within 48 hours and providing a fix timeline within 7 days for critical issues.

Report a vulnerability

Operational hardening checklist

When deploying OptionsLab in a production environment, we recommend:

  • Rotate SECRET_KEY and TRADINGVIEW_WEBHOOK_SECRET on a schedule.
  • Restrict database access to the bot container only — never expose TimescaleDB to the public internet.
  • Use IB paper trading for staging; switch to live only after end-to-end order verification.
  • Enable system-level audit logging (e.g., auditd) on your host.
  • Pin Docker image versions in docker-compose.yml and update on a schedule.
  • Back up the TimescaleDB data volume daily to an off-site location.