Email contact@voxhash.dev with details and reproduction steps.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We will respond within 48 hours and work with you to address the issue.

For detailed security best practices, see docs/SECURITY.md.

• Project license: GPL-3.0-or-later (see LICENSE).
• PyQt6 on PyPI is GPL-3.0 (Riverbank); commercial PyQt is required only if you distribute under a GPL-incompatible license. Bundled desktop installers must preserve GPL notices and Corresponding Source obligations.
• The GPL does not grant trademark rights to “VoxHash”, “ForexSmartBot”, or related marks.
• Not a lawyer / solicitor — review recommended for live-trading distribution.

• Copy .env.example → .env locally. Never commit .env (gitignored).
• Required/optional secret names are listed in .env.example with empty placeholders only — no real values in the repo.
• Do not log API keys, secrets, JWT material, or broker session tokens (including debug/health/companion paths).
• For any future exchange/broker work (Binance, Kraken, DEX adapters, etc.): use least-privilege keys (trade/read as needed; no withdraw), prefer testnet/sandbox first, rotate keys if exposed, and keep secrets on the desktop host only (not in the mobile companion).