Security overview
This page describes what the software does today. It is not an audit or certification; independent review is planned as the product grows.
You run AlgoBee as a node on your own machine or server. Exchange credentials are stored on that node, and orders are sent from it directly to each exchange over TLS. The algobee.net website serves documentation, downloads and public information; it has no route to your exchange accounts.
Exchange secrets (API secrets and private keys) are encrypted with AES-256-GCM, which also detects tampering. The encryption key is unique to each installation and is kept in a separate file readable only by the account running the node. A copy of the database alone does not reveal the secrets.
After a secret is saved, the interface shows it masked and the API does not return it. To change it, enter a new value; leaving the masked value keeps the stored one.
Session tokens are signed with a key unique to each installation, never a shared default. Two-factor authentication can be enabled per user.
Portfolio strategies start in dry run. Venues where live order placement has not been released keep it disabled. The funding strategy raises an alert and pauses new entries when a pair stays unhedged.
Back up the credential key file together with the database. Without the key, stored secrets cannot be decrypted and must be entered again. Nodes that share configuration should be given the same key.
Recommended setup
Good exchange-side settings matter as much as local storage. We recommend:
Create API keys with trading and read access only. AlgoBee never needs withdrawal or transfer permissions.
Where the exchange supports it, restrict each key to the IP address of your node.
Use a sub-account per strategy or venue pairing, so each key's reach and margin are limited.
Please report it privately to security@algobee.net. Include steps to reproduce; we will acknowledge your report and keep you informed while we fix it. Please do not test against accounts that are not your own.