SECURITY

Share strategy defaults, never customer credentials

HYY-Bot separates credential-free strategy settings from the account configuration stored inside each customer's isolated instance.

Isolated customer instances

Each registered customer receives a separate runtime directory, ports, session secrets and configuration file. Supported account credentials remain scoped to that instance.

Safe default restoration

The default template accepts strategy fields only. API keys, secrets, private keys, wallet addresses, passwords, RPC endpoints and notification tokens are excluded and preserved when strategy defaults are restored.

Customer responsibility

Never send private keys, seed phrases, passwords or API secrets in support tickets. Use the narrowest permissions available and rotate credentials when appropriate. No internet-connected system can promise absolute security.