#security

Engineering Practice

Code review that catches bugs: data flow, edge cases, errors, concurrency, security

Daniel Tran · Dec 16, 2025 · 8 min read

Most review comments are about naming and style, while the bugs walk past. How we review for correctness instead: follow the data, probe edge cases and error paths, look for races and trust boundaries, keep PRs small and hand style to machines.

Security

Securing exchange API keys for trading bots: permissions, IP allowlists and rotation

Ryan Pham · Apr 2, 2025 · 5 min read

An exchange API key with withdrawal rights on a bot host is a hot wallet with extra steps. This guide covers the controls we use for trading bot keys: least-privilege permissions, IP allowlists, sub-accounts, secret storage, rotation, logging without leaking signatures, and incident response.