This lab is intentionally constrained:

Every privileged paper action (buy, sell, limit, cancel) is evaluated by AuthGate before any portfolio mutation. Missing, malformed, non-allowlisted, empty, or non-string/bool user ids are rejected. An empty allowlist authorizes nobody. A malformed or wildcard allowlist (*, all, …) raises at config load and does not fall back to a wider set. Unknown auth decisions deny. There is no bypass path in the dispatcher.

• Do not commit .env files or key/PEM/wallet artifacts.
• Do not add configuration keys for private keys, mnemonics, API secrets, CLOB credentials, Telegram bot tokens, encryption keys, or live-trading toggles.
• Run python scripts/security/check_secrets.py in CI/local validation.
• The scanner has two passes: runtime capability identifiers (src/ + pyproject.toml) and secret material across the repository. Docs and tests are not blanket-excluded; educational name mentions without values are allowed.
• Security regression tests live under tests/security/ and assert prohibited dependencies, offline imports, fail-closed auth, scanner accuracy, and generated-state hygiene.

• STARTING_PAPER_CASH must be a finite non-negative number (NaN / Inf rejected).
• Paper amounts and limit prices must be finite; invalid input must not mutate cash, positions, or the journal.
• Supported env keys are paper-only: STARTING_PAPER_CASH, ALLOWED_DEMO_USER_IDS.

• Runtime source must not import network, Telegram, wallet, or process-execution libraries.
• Local journal dumps, SQLite, and paper state directories are gitignored.
• No install/build hooks beyond the polytutor-telegram console script.

.github/workflows/security.yml runs compile, ruff, pytest, and the secret scanner with contents: read only. Actions are SHA-pinned. The workflow requires no repository secrets.

If you find a way to bypass the allowlist or introduce live-trading paths, treat it as a security defect and do not publish credentials or live adapters.