# AegisTrade AI — Pre-Flight Security Checklist

Review and verify every item before deploying or configuring exchange credentials.

| Category | Check Item | Status | Verification Protocol |
| :--- | :--- | :--- | :--- |
| **API Keys** | Read + Trade permissions only (NO withdrawal permissions) | [x] MANDATORY | Verified at initialization; aborts if withdrawal detected. |
| **Credentials** | Demo vs. Live credentials strictly segregated | [x] MANDATORY | Demo keys connect to `api-demo.bybit.com` only. |
| **Secrets** | `.env` excluded from version control | [x] VERIFIED | `.gitignore` locks all `.env` files. |
| **Redaction** | API keys and secrets redacted in structured JSON logs | [x] VERIFIED | `tests/security/test_security.py` passes 100%. |
| **Live Safety** | Live trading hard-locked by default (`ENABLE_LIVE_TRADING=False`) | [x] MANDATORY | Live adapter raises `PermissionError` on boot if lock is engaged. |
| **Kill Switch** | Emergency Kill Switch persists across restarts | [x] VERIFIED | `tests/unit/test_risk_engine.py` verifies DB persistence. |
| **Risk Guardrails**| Max 0.25% equity risk per position enforced | [x] VERIFIED | Decimal position sizer tests verify math. |
| **Circuit Breakers**| Daily loss (1.0%) & max drawdown (5.0%) enforced | [x] VERIFIED | Unit tests confirm trip behavior. |
| **Account Safety** | Small Account Protection refuses sub-minimum trades | [x] VERIFIED | Tested with small $50 balance; trade rejected. |
| **Network** | Bybit TLS 1.3 encryption for REST & WebSockets | [x] VERIFIED | Enforced by standard HTTPS/WSS endpoints. |
| **Auth** | Dashboard endpoints require JWT authentication | [x] VERIFIED | PBKDF2 hashing + HMAC-SHA256 tokens validated. |