Security.

Every page and every API call is served over HTTPS. The site sends a Strict-Transport-Security header, so a browser that has loaded tradingwizard.ai once will refuse to load it over plain HTTP again.

Sign-in runs on NextAuth. A session is a signed token in a cookie your browser sends back, and it lasts seven days before you sign in again. If you use a password, it is stored as a bcrypt hash, so nobody can read it back, us included.

You can turn on two-factor sign-in with an authenticator app, and the shared secret behind it is encrypted before it is stored. You can also register a passkey and sign in with Face ID, Touch ID or a security key instead of a password.

Connecting an exchange is optional. The API secret is encrypted with AES-256-GCM before it is written to the database. The key id stored beside it is not encrypted, so treat it as visible to us, and use a key with the narrowest permissions your exchange allows.

Every bot trades with fake money on live market data. TradingWizard never places a real order for a member, and there is no broker or exchange connection for user trading.

Checkout runs on Stripe, on a page Stripe hosts. Card numbers go to Stripe and never reach our servers, so there is nothing for us to store and nothing for us to lose.

Send it to hi@tradingwizard.ai. Include the URL, what you did, and what you saw. The same address is published at /.well-known/security.txt.

Please do not run tests that degrade the service for other people, and do not open an account that is not yours. There is no paid bug bounty. The service is operated by @ Odero AB (org. no. 559241-0871), Anckargripsgatan 3, 211 19 Malmö, Sweden.