Security & Responsible Disclosure

Crucible implements authenticated AES-256-GCM encryption for storing broker API secrets, TOTP keys, and permanent access tokens.

• Initialization Vectors (IV): A cryptographically strong, non-repeating 12-byte random IV is generated for each secret record.
• Authentication Tags: 16-byte GCM authentication tags guarantee integrity and prevent ciphertext tampering.
• Key Management: Encryption keys are injected via secure environment variables and are never written to source control or logs.
• No Trading Passwords: We do not store raw broker login passwords or 6-digit MPINs.

• TLS 1.3 In-Flight: All client REST API and real-time WebSocket connections are encrypted with TLS 1.3 / HTTPS.
• Row-Level Security (RLS): PostgreSQL database tables enforce strict tenant isolation (`auth.uid() = user_id`), ensuring users can only read/write their own strategies, broker accounts, and trade telemetry.
• Cryptographic Verification: Direct banking settlements and incoming exchange trade alerts require strict cryptographic verification.

To prevent runaway execution and market manipulation, Crucible enforces:

• Pre-Trade Price Collar: Orders outside ±10% of Current Market Price (LTP) are rejected prior to transmission.
• Max Single Order Size: Hard-coded cap of ₹25,00,000 / $30,000 USD per order slice.
• Emergency Kill Switch: One-click emergency square-off and hard halt available across all connected broker APIs.

The quantitative engine underpinning Furnace Studio and Crucible Copilot adheres to strict financial safety protocols:

• Sandboxed Algorithm Compilation: Synthesized Python trading logic is compiled within isolated execution containers with zero host filesystem write permissions and strict network boundaries.
• Prompt Defense & Guardrails: Conversational endpoints enforce strict system prompts that reject requests to bypass broker risk checks, spoof orders, or circumvent exchange limits.
• Credential Isolation: Encrypted broker secrets (AES-256-GCM) are never exposed to LLM context windows or inference logging layers.

We take the security of our trading infrastructure and user funds seriously. If you discover a vulnerability, security flaw, or algorithmic leakage vector, please report it responsibly: