Security

docs/security.md

Security and Public Safety

Security Approach

This case study includes security from a software engineering perspective, not as the main product category.

The focus is on:

Safe backend access patterns.
Secrets outside source code.
Controlled API boundaries.
Validation with schemas.
Stable contracts.
Safer Electron architecture.

Backend Safety

Public-safe backend practices include:

Authorization for protected access.
Environment-based configuration.
No secrets in source code.
Input validation.
Output shape control.
Encapsulation of external integrations.
Health endpoint for basic service verification.

Do not publish:

Tokens.
Private URLs.
Headers.
.env values.
Broker credentials.
Full production responses.

Electron Safety

Meridian follows a safer Electron model:

Main handles privileged capabilities.
Preload exposes a limited API.
Renderer does not directly access Node.js APIs.
Communication between layers is explicit.
Local persistence is controlled.

This prevents the UI layer from becoming an unrestricted system-level context.

Trading Logic Protection

The public repo intentionally avoids exposing:

Scoring formulas.
Thresholds.
Entry/exit rules.
Gating conditions.
Strategy internals.
Full reason-code mappings.
Complete production schemas.

This protects the intellectual property of the trading workflow while still showing the engineering quality of the platform.

Public Screenshots

Screenshots should be:

Demo-only.
Anonymized.
Free of tokens.
Free of private URLs.
Free of account/broker identifiers.
Free of production payloads.

Recommended approach:

Use controlled mock/demo data.
Blur or remove anything sensitive.
Avoid showing browser/network tabs.
Avoid showing raw API payloads if they expose internal logic.

There aren't any published security advisories