soritrading
Komunidad ↗Mag-login
About soritradingMarket data & premiumCommunity & news5-minute quick startAllocator — splitting money across strategiesSecurity — non-custodialLocal agentStrategy API (ctx)External signals (TradingView & APIs)Create an AI StrategyFor AI assistantsStart trading Korean stocksPublic tradersWATCH TOGETHER (P2P condition sharing)
Gumawa ng server ↗Gabay na may screenshot para gumawa ng server (VPS) na magpapatakbo ng estratehiya sa loob ng 5–10 minuto — 10 wikaSupabase na external DBGumawa ng libreng Postgres at ikonekta ito gamit ang read-only na accountMaglagay ng pampublikong dataI-load sa sarili mong DB ang libreng data gaya ng Fear & Greed, hash rate at interest rate, at gamitin ito sa mga estratehiyaReal-time na paggising gamit ang RedisPakilusin ang estratehiya sa sandaling pumasok ang bagong value — sariling install, maraming server, o libreng managed na serbisyoSimulan ang forex (MT5)Mag-backtest gamit ang MT5 account ng iyong broker at patakbuhin ito sa paper → demo → totoong accountMagrehistro ng device para sa proteksyon ng codePaano piliin at kumpirmahin ang mga device na makakapagbukas ng protektadong code ng estratehiyaP2P WebSocket API (Ingles) ↗Ikonekta ang sarili mong bot o script sa P2P daemon para makatanggap ng kumpirmadong WATCH TOGETHER na alerto — mga client sa JavaScript at Python

Security — non-custodial

One-line principle

Both decision and execution (keys, signing, submission) happen on the agent on your device. soritrading servers are not in the trade path.

  • API keys never go to soritrading servers. Orders are signed and sent by your agent directly to the exchange.
  • The server holds no keys, so it cannot place orders at the exchange itself, and it does not place orders on your behalf.
  • Even if the soritrading backend is compromised, the server alone cannot command your agent — the agent only accepts connections signed by your trusted device.

What this does not stop — honestly

We do not say "absolutely safe". The remaining risks:

  • Malware on your own device (browser) · phishing sites — commands are signed on your trusted device, so whoever controls that device or screen can send them. Check the official domain in the address bar.
  • If the key itself is stolen, it can be used without our software. All that is left then are the limits the exchange put on the key (no withdrawal permission · IP restriction) — turn on IP restriction where the exchange supports it.
  • If your own server (VPS) is compromised — that is your responsibility.

E2E encrypted remote control

Commands from your browser to the agent (key registration · turning live orders on · remote control) travel with end-to-end encryption (ECDH P-256 + AES-256-GCM). The server relays ciphertext it cannot read. If the web UI and the agent show the same fingerprint, there is no one in the middle.

The scope, too: this encryption covers commands. Fills, balances, performance and logs that the agent reports to the server are received and stored by the server so the screens can show them.

Key safeguards

  • Keys without withdrawal permission are the default. When registering a key, the agent asks the exchange about its permissions where it can and rejects keys with withdrawal enabled; where the exchange cannot be asked, it shows "could not verify" (never drawn as safe).
  • Keys are stored encrypted only on the agent's machine. You can also enter them directly on your server (VPS) without going through the web (agent console command).
  • Exchanges that cannot separate withdrawal (e.g. decentralised exchanges signed with a wallet key) are supported too. In that case the key form warns you and asks for explicit consent, and the agent is designed to use only trading functions (orders, balances, positions) and block withdrawals and transfers. The key stays only on the agent, like any other key.
  • For decentralised exchanges a delegated key (a trade-only API key or agent wallet you approve from your own wallet on the exchange) comes first. Only where there is none do we take the private key of a dedicated wallet that holds just your trading funds. We never take seed phrases or your main wallet key — anything that looks like a seed is blocked by the web before sending, and refused by the agent too.

Guardrails

Real orders need a wallet size (= the most it can lose) and live orders turned on separately. Order-rate limits, approval ceilings and manual stop still apply.

Security of your own server (VPS) is your responsibility. Use keys without withdrawal permission, and turn on IP restriction where the exchange supports it.