[SECURITY] Phase 1.1 — Secure Credential Management

[sjackson0109]

Phase 1.1 — Secure Credential Management

TODO Reference

• Phase: Phase 1: Critical Security & Stability (Weeks 1–4)
• Category: 1.1 Secure Credential Management
• Priority: Critical

Overview

Replace all plaintext credential storage with an encrypted vault, implement credential rotation, and add API key permission validation on startup. app/pt_credentials.py provides the Fernet-based vault foundation — this issue tracks completing and wiring it throughout the application.

---

Tasks

Replace Plaintext Credential Storage

• Remove any remaining r_key.txt / r_secret.txt plaintext files from codebase and .gitignore them
• Ensure pt_credentials.py encrypt_credentials() / decrypt_credentials() are used everywhere credentials are read or written
• Add secure key derivation from machine-specific parameters
• Create credential migration script for users upgrading from plaintext format
• Add credential validation on startup — reject startup if credentials are corrupt or missing

Credential Rotation Mechanism

• Create scheduler for automatic key rotation
• Add rotation notification system (log + GUI alert)
• Implement graceful credential transition (old key still valid during transition window)

API Key Permission Validation

• Validate exchange API permissions on startup (read-only vs. trade vs. withdraw)
• Create permission audit logging via pt_security_logger.py
• Add permission compliance checks — warn if key has more permissions than required

---

Files to Modify

• app/pt_credentials.py — complete vault implementation, add rotation scheduler
• app/pt_trader.py — replace any direct config/file credential reads
• app/pt_security.py — integrate permission validation
• app/pt_security_logger.py — credential usage and rotation audit events

---

Acceptance Criteria

• No plaintext credentials anywhere in codebase or committed files
• All credential reads go through pt_credentials.py vault
• Credential rotation tested and documented
• API permission validation runs on startup with clear log output
• Security audit log records every credential access event

Dependencies

None — implement first, all other Phase 1 tasks benefit from this foundation.

[github-actions]

🚨 SECURITY ISSUE DETECTED

This issue has been automatically flagged as a security concern.

Immediate Actions Required:

1. Review the security impact assessment
2. Assign to security team member
3. Create hotfix branch if critical
4. Test fix in isolated environment
5. Deploy security patch as soon as possible

Security Review Checklist:

• Security impact assessed
• Fix approach reviewed
• No sensitive data exposed in issue
• Patch tested in isolation
• Documentation updated

Please treat this with appropriate urgency based on the risk level indicated.