decodedtrading
RUConsole
Back to home

Security Policy

Last updated: September 8, 2026

1. Exchange Credential Handling

An exchange API key grants the permissions you enable on the exchange. Read and trade access can expose account information and change positions, even when withdrawals are disabled.

  • Credential storage: Saved exchange keys, secrets and required passphrases are managed through HashiCorp Vault.
  • Execution access: The backend issues time-limited wrapped credentials for execution services to use in configured sessions and strategies.
  • Account access: Exchange connections are associated with your Decoded account. Protect your sign-in account as well as the exchange keys you connect.

2. Network Security and IP Whitelisting

Review the current connection instructions before configuring exchange API access:

  • IP restrictions: Use the server IP addresses shown in the current Decoded connection instructions when your exchange supports an allowlist. Confirm the addresses before saving a key. IP restrictions reduce where a key can be used; they do not remove its trading authority or guarantee protection from compromise.
  • Connection checks: Use the official HTTPS console and exchange websites. Do not send API secrets through email, chat or screenshots.

3. Recommended API Security Configuration

Configure each key for the service and market you intend to use:

  • No Withdrawal Permission: Decoded does not require withdrawal capabilities. Never activate "Enable Withdrawals" on your exchange API key.
  • Market permissions: Trade Copier requires read and trade access for its supported futures market. Security Strategy permissions depend on the selected Binance product, such as Spot, Margin, USD-M or COIN-M. Enable only the permissions needed for your configuration.
  • Key lifecycle: Check the exchange's current expiry and access rules. Review keys regularly and revoke or replace any key you no longer use or suspect has been exposed.

4. Stopping Access and Reviewing Orders

To stop a key from authorizing further API requests, revoke it on the exchange. Removing a connection in Decoded and revoking a key on the exchange are separate actions. Review any running sessions, strategies, open orders and positions; revoking API access does not itself cancel placed exchange orders or close positions.

5. Reporting Vulnerabilities

Report a suspected vulnerability to security@decodedtrading.com. Include the affected feature, time and steps to reproduce, without API keys, secrets or other users' personal data. If a key may be exposed, revoke it on the exchange while the report is investigated.