Security notes
- Secrets:
.envon the node only (mode 600), never in git, never sent to the browser;SettingsareSecretStr; structlog redaction processor + regex onuserid|api_key|token|password|secret=; httpx logging silenced. Tests assert the vendor id never appears in API responses, OpenAPI, audit, job results or raw-archive metadata. - Auth: argon2id passwords, TOTP (pyotp) with obfuscated secret storage, 12 h sessions (hashed ids), CSRF double-submit on every non-GET browser request, SameSite=Strict + Secure + HttpOnly cookies, login rate limit (10/min/IP).
- API keys:
fd_<prefix>.<secret>, HMAC-SHA256 hashed, scopesread:market read:fundamentals query export admin, optional expiry, revocation, per-key rate limit, daily usage rows. - Transport: TLS at the MacLustr Tunnel (Caddy, BHS64); API bound to 127.0.0.1; HSTS; CSP
default-src 'self';X-Frame-Options: DENY; request ids on every response. - Query sandbox: DuckDB in-memory,
allowed_directories= lake curated/_retired,enable_external_access=false, single SELECT/WITH statement, keyword deny-list, timeout, row cap. - Exports: owner/principal scoped, 72 h expiry, served from
lake/exportsonly. - Dependency scanning:
make audit(pip-audit) in CI (.github-less: run on the node before deploy; results in STATUS.md). - Encryption at rest: Apple internal SSD; FileVault is disabled on M3U96a by cluster policy (auto-login after power loss, decision 2026-09-10). Backups go over SSH to a LAN node with the same policy. If encryption at rest becomes a requirement, enable FileVault on M3U96a and M4M64a (trade-off: unattended reboot requires a manual unlock).
- License: FirstRate Data private use — the platform exposes no public data route; redistribution of bars/tables to third parties is prohibited and surfaced in the console and the API catalog.