This is a demo repository with simulated functionality. It does not handle:

• Real trading data
• Live broker connections
• Actual financial transactions
• Production credentials

However, we still take security seriously for:

• Code quality and safety
• Dependency vulnerabilities
• Best practices demonstration

If you discover a security vulnerability in this demo code, please report it by:

Send details to: [email protected]

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity

This demo follows Rust security best practices:

✅ Dependencies

• Regular cargo audit checks
• Minimal dependency footprint
• Well-maintained crates only

✅ Code Quality

• No unsafe code in demo
• Clippy lints enforced
• Input validation

✅ Data Handling

• No sensitive data in demo
• Local file storage only
• No external API calls (mock only)

• Dependency vulnerabilities
• Code injection possibilities
• Unsafe memory access
• Path traversal issues

• Trading strategy vulnerabilities (demo only)
• Performance issues
• UI/UX bugs
• Feature requests

Note: This demo does not represent production security measures. Production Matchstick includes:

• Enterprise-grade authentication
• Encrypted credential storage
• Audit logging
• Rate limiting
• TLS/SSL for all connections
• SOC 2 compliance (planned)

For production security details, visit matchstick.trading

We follow responsible disclosure:

1. Report sent to [email protected]
2. We acknowledge receipt within 48 hours
3. We investigate and develop fix
4. We release patched version
5. Public disclosure after users can update

Security updates will be:

• Released as patch versions (e.g., 0.0.3)
• Documented in CHANGELOG.md
• Announced via GitHub Security Advisories
• Noted in release notes

• Security Issues: [email protected]
• General Questions: [email protected]
• GitHub Issues: For non-security bugs only

Thank you for helping keep Matchstick and its users safe!