Security and Vulnerability Disclosure
Owner and access
WT Strategies is one sole-hosted installation owned and operated by James Williams on the Owner’s own hardware, for the Owner’s own accounts. Access is family-only. A Viewer may be invited only with James Williams’s written consent on file. Viewer access is read-only and limited to delayed or last-close information, with no trading authority or access to broker keys. Users (other traders) are not currently offered; their invitation flow is disabled. The software is not distributed.
Security model
At enrollment, the Owner and Viewers must register a passkey; passkeys are the primary sign-in method with TOTP as a fallback. The target architecture places the Owner’s broker keys in the Owner’s LIVE vault, with Cloudflare and CONTROL relaying encrypted key material. Viewers must not receive broker keys, trading controls or live prices.
Report a vulnerability
Please send a concise report to security@wt-strategies.com. Include the affected version, impact, and steps to reproduce. Do not include credentials, account identifiers, or personal financial data. We aim to acknowledge a report within 5 business days. We welcome good-faith, non-disruptive testing of our software. Do not access another person’s data, disrupt services, or change or delete data. To the extent permitted by law, we will not pursue legal action for accidental, good-faith violations promptly reported to us. Coordinate public disclosure with us.
Scope and support
This contact is for security reports about WT Strategies software and this disclosure site. It is not an emergency trading-support channel. General help is on the Contact and Support page.