• Secrets are environment-only.
• Logs redact common secret field names.
• IBKR paper settings are validated on startup when enabled.
• The UI exposes no live trading mode.
• AI output is schema-constrained and never directly executes broker calls.
• Emergency stop prevents further accepted BUY decisions.
• Idempotency keys protect order proposals.
• Local single-user login and CSRF checks protect sensitive mutations when IBKR execution is enabled.
• Rate limiting covers login, bot-run, emergency and broker sync endpoints.
• Production startup refuses LOCAL_AUTH_PASSWORD=change-me.

Production hardening still needs persistent session storage and broader perimeter controls.