Security & Responsible Disclosure

Cryptographic Architecture & Vulnerability Reporting Standards

AES-256-GCM Vault
Infrastructure Architecture & Security Desk

Crucible (Public Beta Edition) • Security Desk: security@crucible.trade

Engineered by Priyankit Raj • Built in compliance with SEBI Cybersecurity Guidelines & IT Rules 2021.

1. Broker Credential & API Key Encryption

Crucible implements authenticated AES-256-GCM encryption for storing broker API secrets, TOTP keys, and permanent access tokens.

  • Initialization Vectors (IV): A cryptographically strong, non-repeating 12-byte random IV is generated for each secret record.
  • Authentication Tags: 16-byte GCM authentication tags guarantee integrity and prevent ciphertext tampering.
  • Key Management: Encryption keys are injected via secure environment variables (`ENCRYPTION_KEY`) and are never written to source control or logs.
  • No Trading Passwords: We do not store raw broker login passwords or 6-digit MPINs.

2. Transport Layer Security & Database Isolation

  • TLS 1.3 In-Flight: All client REST API and real-time WebSocket connections are encrypted with TLS 1.3 / HTTPS.
  • Row-Level Security (RLS): PostgreSQL database tables enforce strict tenant isolation (`auth.uid() = user_id`), ensuring users can only read/write their own strategies, broker accounts, and trade telemetry.
  • HMAC Webhook Verification: Razorpay payments and incoming exchange trade alerts require HMAC SHA-256 signature verification.

3. Algorithmic Pre-Trade Guardrails

To prevent runaway execution and market manipulation, Crucible enforces:

  • Pre-Trade Price Collar: Orders outside ±10% of Current Market Price (LTP) are rejected prior to transmission.
  • Max Single Order Size: Hard-coded cap of ₹25,00,000 per order slice.
  • Emergency Kill Switch: One-click emergency square-off and hard halt available across all connected broker APIs.

4. Responsible Vulnerability Disclosure Program

We take the security of our trading infrastructure and user funds seriously. If you discover a vulnerability, security flaw, or algorithmic leakage vector, please report it responsibly:

Security Reporting Channel:
security@crucible.trade
Response SLA: Acknowledged within 48 hours • Technical remediation within 7 business days.

Guidelines for Ethical Researchers:

  • Do not access or modify data belonging to other accounts without authorization.
  • Do not execute denial-of-service (DoS/DDoS) attacks against production infrastructure.
  • Provide reasonable time for our engineering team to patch the issue before public disclosure.