> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hoox.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets & Network Security

> How to manage encrypted Cloudflare Worker Secrets, secure Zero Trust service boundaries, and configure edge firewalls and IP allowlists.

Security is the most critical component of the Hoox trading platform. When deploying automated execution scripts, your capital and API credentials must be protected against malicious exploits, unauthorized webhook payloads, and network interceptions.

This guide outlines our **Zero Trust security architecture**, encrypted secret management procedures, and edge-level firewall protection runbooks.

***

## 🛡️ 1. Zero Trust Network Isolation

Traditional trading systems expose database and exchange execution APIs to the public internet (secured by simple HTTP headers or ports). This creates an active attack surface.

Hoox implements a strict **Zero Trust microservice isolation topology**:

```text theme={null}
[Public Internet] ───► [Cloudflare WAF / Firewall]
                                │
                        (IP & Auth Checks)
                                │
                                ▼
                       [Gateway (hoox)] (Publicly Accessible Node)
                                │
               ┌────────────────┴────────────────┐
               │ V8 Isolate Service Bindings     │
               │ (Private, Encrypted, Zero-TCP)  │
               └────────────────┬────────────────┘
                                │
              ┌─────────────────┼─────────────────┐
              ▼                 ▼                 ▼
       [trade-worker]      [d1-worker]      [agent-worker]
       (No Public URL)   (No Public URL)   (No Public URL)
              │                 │                 │
     (Exchange Orders)   (SQLite Queries)   (AI Risk Audits)
```

* **No Public Endpoints**: The `trade-worker`, `d1-worker`, and `agent-worker` literally **do not exist** on the public internet. They have no public IP addresses or URLs.
* **V8 Service Bindings**: Communication between the public gateway (`hoox`) and internal compute nodes is routed entirely inside Cloudflare's secure V8 engine isolates. Your trade routing data, database queries, and private logs never travel over the public internet, eliminating TLS decryption and packet-sniffing risks.

***

## 🔑 2. Encrypted Secret Management via CLI

API keys, exchange secrets, and Telegram bot tokens are never committed to git repositories or written in plain-text configuration files. Instead, they are stored directly on Cloudflare’s hardware-secured key vaults.

The Hoox CLI features deep encryption integrations to automate secret provisioning:

```bash theme={null}
# 1. Inject a secure exchange credential (e.g. Bybit Secret)
hoox secrets set BYBIT_API_SECRET "your_private_signature_here"

# 2. Check the synchronization status of all required edge secrets
hoox secrets check
```

### The Secrets Diagnostic Report

Running `hoox secrets check` queries Cloudflare's API to confirm that the key binding exists on the edge, without ever exposing or decrypting the actual values in your terminal:

```text theme={null}
┌────────────────────────────────────────────────────────┐
│               Cloudflare Edge Secrets Audit            │
├────────────────────────────────────────────────────────┤
│  BYBIT_API_KEY ........... ✅ PRESENT (Active)          │
│  BYBIT_API_SECRET ........ ✅ PRESENT (Active)          │
│  TELEGRAM_BOT_TOKEN ...... ✅ PRESENT (Active)          │
│  OPENAI_API_KEY .......... ⚠️ MISSING (Optional)       │
│                                                        │
│  Audit Result: SECURE (All required secrets bound)     │
└────────────────────────────────────────────────────────┘
```

***

## 🧱 3. Webhook Firewall & TradingView IP Allow-listing

To ensure that only TradingView's official servers can fire signals to your `/webhook` gateway:

<ol>
  <li>
    <strong>Passkey Verification</strong>: The gateway checks the{" "}
    <code>apiKey</code> property inside the JSON payload against your secure
    manifest in <code>CONFIG\_KV</code>.
  </li>

  <li>
    <strong>Cloudflare WAF (Web Application Firewall)</strong>: Since
    TradingView publishes their official IP ranges, you can configure
    Cloudflare's edge firewall to block all webhook traffic that does not
    originate from these verified IPs.
  </li>
</ol>

```bash theme={null}
# Auto-configure WAF rules to lock the /webhook route to TradingView IPs
hoox waf configure --TradingView-only
```

***

## 📋 4. Security Best Practices Checklist

* **Least Privilege API Keys**: When creating API keys on Bybit, Binance, or MEXC, **never** enable "Withdrawal" permissions. Only check "Trade" and "Account Read" permissions.
* **Credential Rotation**: Automatically rotate your exchange API keys every 90 days. Deleting old keys and injecting new ones takes less than 60 seconds with `hoox secrets set`.
* **Zero-Commit Rule**: Verify that your `.env.local` and `.dev.vars` files are registered in your workspace's `.gitignore` file to prevent accidental pushes to public repos.
* **Emergency Response**: If you suspect a strategy error or exchange anomaly, immediately halt all execution via the CLI:
  ```bash theme={null}
  hoox monitor kill-switch on
  ```

### 🔗 Next Steps

* [**Platform Configuration Guide**](../getting-started/configuration) — Map environment variables, secrets, and KV runtime settings.
* [**Local Development & Testing**](local-development) — Run local wrangler sandboxes with securely encrypted `.dev.vars`.