← Back to HomeSecurity

Built Security-First
From the Ground Up.

Trading credentials and API tokens must never be exposed in the frontend. N1God AI enforces this principle at every layer of the architecture.

TLS 1.3HSTS ActiveZero Frontend SecretsFull Audit TrailRBAC Enforced
🔐
Encrypted Credentials

Trading account credentials and API keys are stored exclusively on the server. They are never transmitted to the browser or logged in any accessible location.

  • ✓Server-side credential storage
  • ✓No credentials in browser storage
  • ✓Encrypted at rest
  • ✓Access via service accounts only
🛡️
Backend-Only Secrets

All sensitive tokens — MT5 bridge, Telegram bot, broker API — are loaded from environment variables on the server process only.

  • ✓Environment variable injection
  • ✓Secrets never exposed to frontend
  • ✓Separate .env per environment
  • ✓No secrets in version control
👤
Role-Based Access Control

Three access tiers: Admin (full system control), Operator (execution and monitoring), and Investor (read-only account view).

  • ✓Admin, Operator, Investor roles
  • ✓Per-route access enforcement
  • ✓Token-based session management
  • ✓Session expiry and revocation
📝
Full Audit Trail

Every trade, login attempt, configuration change, and risk gate decision is recorded with a timestamp and source.

  • ✓Trade lifecycle logging
  • ✓Authentication event logging
  • ✓Risk decision records
  • ✓Immutable timestamped entries
🔒
HTTPS Everywhere

TLS 1.3 enforced across all endpoints. HTTP is permanently redirected with a 308 code. HSTS with includeSubDomains is active.

  • ✓TLS 1.3 only
  • ✓308 permanent HTTP redirect
  • ✓HSTS with includeSubDomains
  • ✓max-age=31536000 (1 year)
🖥️
VPS Infrastructure Security

The production VPS runs with key-only SSH authentication, a firewall that restricts all non-essential ports, and continuous service health monitoring.

  • ✓SSH key-only authentication
  • ✓Firewall: 22, 80, 443 only
  • ✓Root login restricted
  • ✓Continuous health checks
Compliance

OWASP Top 10 Coverage

N1God AI is designed to address all ten categories in the OWASP Top 10 security risk list. Each known class of vulnerability is explicitly mitigated in the architecture.

Broken Access ControlRole-based access enforced on every route
Cryptographic FailuresTLS 1.3, encrypted credentials at rest
Injection AttacksInput validation, parameterized queries, no raw SQL
Insecure DesignSecurity-first architecture from day one
Security MisconfigurationHardened Nginx, minimal attack surface
Vulnerable ComponentsDependency audits on every deployment
Authentication FailuresToken-based auth with expiry and revocation
Data Integrity FailuresAudit logs and signed deployment artifacts
Security Logging GapsFull event logging across all services
SSRFInternal network access restricted to required services only