# BAD api_key = "sk-1234567890abcdef" password = "mypassword"

# GOOD import os api_key = os.getenv('API_KEY') password = os.getenv('PASSWORD')

# .env file (not in git) API_KEY=sk-1234567890abcdef PASSWORD=mypassword # In code from dotenv import load_dotenv load_dotenv() api_key = os.getenv('API_KEY')

def validate_symbol(symbol: str) -> bool: """Validate trading symbol.""" if not symbol or len(symbol) > 20: return False # Check format if not re.match(r'^[A-Z]{3,6}(=X)?$', symbol): return False return True # Use validation if not validate_symbol(user_input): raise ValueError("Invalid symbol")

# BAD query = f"SELECT * FROM trades WHERE symbol = '{symbol}'" # GOOD query = "SELECT * FROM trades WHERE symbol = ?" cursor.execute(query, (symbol,))

# Use keyring for secure storage import keyring # Store keyring.set_password("forexsmartbot", "api_key", api_key) # Retrieve api_key = keyring.get_password("forexsmartbot", "api_key")

from functools import wraps import time def rate_limit(calls_per_second): min_interval = 1.0 / calls_per_second last_called = [0.0] def decorator(func): @wraps(func) def wrapper(*args, **kwargs): elapsed = time.time() - last_called[0] left_to_wait = min_interval - elapsed if left_to_wait > 0: time.sleep(left_to_wait) ret = func(*args, **kwargs) last_called[0] = time.time() return ret return wrapper return decorator @rate_limit(10) # 10 calls per second def api_call(): # Your API call pass

# GOOD url = "https://api.example.com/data" # BAD url = "http://api.example.com/data" # Insecure

from cryptography.fernet import Fernet # Generate key (store securely) key = Fernet.generate_key() cipher = Fernet(key) # Encrypt encrypted = cipher.encrypt(b"sensitive data") # Decrypt decrypted = cipher.decrypt(encrypted)

import html # Sanitize user input user_input = html.escape(user_input) # Validate data types if not isinstance(value, (int, float)): raise TypeError("Invalid data type")

import os import stat # Create secure file with open('secrets.json', 'w') as f: f.write(secrets) # Set permissions os.chmod('secrets.json', stat.S_IRUSR | stat.S_IWUSR) # 600

import secrets import string def generate_password(length=16): """Generate secure random password.""" alphabet = string.ascii_letters + string.digits + string.punctuation return ''.join(secrets.choice(alphabet) for _ in range(length))

import secrets # Generate secure token token = secrets.token_urlsafe(32) # Store securely (not in code) # Use environment variables or secure storage

import secrets from datetime import datetime, timedelta class Session: def __init__(self, user_id): self.user_id = user_id self.token = secrets.token_urlsafe(32) self.expires = datetime.now() + timedelta(hours=1) def is_valid(self): return datetime.now() < self.expires

# BAD raise Exception(f"API key {api_key} is invalid")

# GOOD raise ValueError("Invalid API credentials")

# BAD logger.info(f"API key: {api_key}") # GOOD logger.info("API authentication successful")

try: # Sensitive operation result = process_data(data) except Exception as e: # Log error without sensitive data logger.error(f"Processing failed: {type(e).__name__}") # Don't expose stack traces in production if DEBUG_MODE: raise else: return None

import ssl # Verify SSL certificates context = ssl.create_default_context() context.check_hostname = True context.verify_mode = ssl.CERT_REQUIRED

import logging # Log network requests logging.basicConfig(level=logging.INFO) logger = logging.getLogger('requests') logger.setLevel(logging.INFO)

from forexsmartbot.builder import StrategyBuilder builder = StrategyBuilder() # ... build strategy ... # Validate before sharing is_valid, errors = builder.validate_strategy() if not is_valid: raise ValueError(f"Strategy validation failed: {errors}")

# Use restricted execution environment # (Future feature: Strategy sandbox)

ENV = os.getenv('ENVIRONMENT', 'development') if ENV == 'production': api_key = os.getenv('PROD_API_KEY') else: api_key = os.getenv('DEV_API_KEY')

def require_permission(permission): def decorator(func): @wraps(func) def wrapper(*args, **kwargs): if not has_permission(permission): raise PermissionError("Access denied") return func(*args, **kwargs) return wrapper return decorator @require_permission('trade') def execute_trade(): # Trading logic pass

import logging audit_logger = logging.getLogger('audit') def log_trade(trade_details): audit_logger.info(f"Trade executed: {trade_details}") # Don't log sensitive data like API keys