RegimeRoute defaults to paper trading and accepts no exchange credentials.

Implemented controls include scrypt password verification, opaque hashed server-side sessions, HttpOnly/SameSite cookies, Secure cookies in production, CSRF checks, Redis and nginx rate limits, exact production origin enforcement, owner-scoped resources and WebSocket payloads, database tenant-consistency constraints, request validation, bounded request bodies, security headers, internal-only data services, non-root application containers, dropped capabilities, no-new-privileges, and read-only production filesystems where practical.

nginx limits API traffic per source IP to a sustained 10 requests/second and allows a 100-request nodelay burst. This intentionally accommodates dashboard fan-out and the documented controlled 100-request paper-trading probe without removing sustained abuse protection. Requests beyond the burst receive HTTP 429. Authentication has additional application-level Redis limits; order correctness does not depend on nginx throttling.

Production secrets belong in .env and protected host files. Never commit cookies, session/CSRF values, database passwords, TLS private keys, cloud credentials, dumps, or logs. Rotate SESSION_SECRET after suspected compromise (all sessions become invalid), rotate database credentials, revoke remote-backup credentials, and replace TLS keys as applicable.

Limits: no MFA, email verification, password reset, PostgreSQL row-level security, external identity provider, signed receipts, trusted timestamps, WAF, SIEM, HA, or real-money controls. SHA-256 receipts are tamper-evident, not signed attestations. Operators must perform external monitoring, host patching, firewalling, encrypted off-host backup, vulnerability review, and incident response.

Report vulnerabilities privately to the repository owner; do not place exploit details or credentials in a public issue.