Security is the most critical component of the Hoox trading platform. When deploying automated execution scripts, your capital and API credentials must be protected against malicious exploits, unauthorized webhook payloads, and network interceptions.
This guide outlines our Zero Trust security architecture, encrypted secret management procedures, and edge-level firewall protection runbooks.
🛡️ 1. Zero Trust Network Isolation
Traditional trading systems expose database and exchange execution APIs to the public internet (secured by simple HTTP headers or ports). This creates an active attack surface.
Hoox implements a strict Zero Trust microservice isolation topology:
- No Public Endpoints: The
trade-worker, d1-worker, and agent-worker literally do not exist on the public internet. They have no public IP addresses or URLs.
- V8 Service Bindings: Communication between the public gateway (
hoox) and internal compute nodes is routed entirely inside Cloudflare’s secure V8 engine isolates. Your trade routing data, database queries, and private logs never travel over the public internet, eliminating TLS decryption and packet-sniffing risks.
🔑 2. Encrypted Secret Management via CLI
API keys, exchange secrets, and Telegram bot tokens are never committed to git repositories or written in plain-text configuration files. Instead, they are stored directly on Cloudflare’s hardware-secured key vaults.
The Hoox CLI features deep encryption integrations to automate secret provisioning:
The Secrets Diagnostic Report
Running hoox secrets check queries Cloudflare’s API to confirm that the key binding exists on the edge, without ever exposing or decrypting the actual values in your terminal:
🧱 3. Webhook Firewall & TradingView IP Allow-listing
To ensure that only TradingView’s official servers can fire signals to your /webhook gateway:
- Passkey Verification: The gateway checks the
apiKey property inside the JSON payload against your secure
manifest in CONFIG_KV. - Cloudflare WAF (Web Application Firewall): Since
TradingView publishes their official IP ranges, you can configure
Cloudflare’s edge firewall to block all webhook traffic that does not
originate from these verified IPs.
📋 4. Security Best Practices Checklist
- Least Privilege API Keys: When creating API keys on Bybit, Binance, or MEXC, never enable “Withdrawal” permissions. Only check “Trade” and “Account Read” permissions.
- Credential Rotation: Automatically rotate your exchange API keys every 90 days. Deleting old keys and injecting new ones takes less than 60 seconds with
hoox secrets set.
- Zero-Commit Rule: Verify that your
.env.local and .dev.vars files are registered in your workspace’s .gitignore file to prevent accidental pushes to public repos.
- Emergency Response: If you suspect a strategy error or exchange anomaly, immediately halt all execution via the CLI:
🔗 Next Steps
Last modified on July 5, 2026
