A safety check for the trading tool you built with AI
Building a trading or investing tool with a coding agent takes an evening, and checking what that tool can do with your account takes about one more. Describe your own tool and see where it stands.
Walk through the checksA dashboard with all your positions, a journal that updates itself or a small bot that places an order when a condition is met can all be built in one evening with a coding agent. What tends to get skipped in that evening is the question of what the tool can actually do with your account, and who else might be able to do it too.
The research on AI-written code isn't very reassuring on that front, so this page walks through the places your tool connects to, lets you describe your own and ends with the nine questions to go through this week.
Every connection your tool has is a door worth checking.
Scroll through the six steps. The map lights up one connection at a time, from the key you gave your tool to the code you never wrote yourself.
One evening of building, and nobody else checks it
When Veracode gave more than 100 language models 80 coding tasks, the code introduced a known type of security flaw in 45% of the cases, and the models hadn't become any better at writing safe code even as they got better at writing code that runs.
Most figures here come from security companies, so read them as a direction rather than an exact measurement.
What your key allows
Most brokers and exchanges let you decide what a key can do when you create it. A dashboard or journal only needs to read, a bot that places orders needs to trade, and almost no tool you build yourself needs permission to withdraw.
Where your key ends up
In the code, in a .env file that got committed anyway, in an MCP server's configuration, in a chat where you pasted it to fix an error, or in a screenshot. GitGuardian counted around 29 million secrets that ended up in public code on GitHub in 2025.
Is your tool open to everyone?
On your laptop, very few people can reach it. Once it's online, that changes completely: a researcher found that 170 of 1,645 showcase apps on Lovable had a database anyone could read or write without logging in.
When your tool reads something someone else wrote
A language model can't reliably tell the text it should read from an instruction hidden inside it. With your data, someone else's content and a way to send something out in one place, a well-written piece of text can get your data sent out.
MCP servers, packages and the agent itself
An MCP tool's description can hide instructions the user never sees, 19.7% of the packages language models recommended in one study didn't exist, and the coding agent that builds your tool can see everything in your project folder, including your keys.
Now try it on your own tool.
Describe the tool you built, and the report shows what someone could do with your account if its key leaked tonight, and which checks still need doing.
Illustrative only. The report follows the article's rules of thumb and doesn't inspect a real tool or key. Permission names and options differ per broker and exchange; the three levels follow Kraken's API key documentation as an example. A tool that places orders counts as a way to send something out, and a tool that reads news or research counts as reading content from someone else.
A leaked withdrawal key can take the money out.
Kraken splits its keys into separate permissions for querying funds, reading open and closed orders, creating and modifying orders, and withdrawing funds, and its documentation says that a key used only for placing orders doesn't need the permission to withdraw. Locking the key to the IP address your tool runs from, according to Kraken, prevents almost all misuse even when the key does leak.
You can also let your code guard this for you. In our trading journal, a test fails as soon as an order function appears anywhere in the code, so the agent can't quietly add one later without that test going red.
Add functions to a read-only journal, then run its test
Illustrative only. The function names are invented; the rule (fail as soon as any order function appears) is the one described in the article.
A key that has been somewhere it shouldn't gets replaced.
Deleting the file or the message doesn't undo the fact that the key was out there. GitGuardian found 24,008 secrets in public MCP configuration files alone, and counted around 29 million secrets in public code on GitHub in 2025, 34% more than the year before.
GitHub has blocked pushes that contain many known types of keys to public repositories by default since 2024, which helps, but it only recognises the key formats it knows, it doesn't cover private repositories without a paid add-on, and it can't see a chat or a screenshot at all.
Where has your key been?
Illustrative only, based on GitHub's description of push protection (2024). Push protection can also be bypassed or switched off.
Open it in a private window and see what a stranger sees.
In March 2025, a researcher looked at 1,645 apps from the showcase of Lovable, a popular platform for building apps with AI, and found that 170 of them had a database that anyone could read or write without logging in, exposing things like email addresses, payment status and API keys. A later scan of more than 5,600 such apps by the security company Escape found more than 400 exposed secrets and 175 cases of personal data, including bank account numbers.
The quickest check is to open your tool without logging in, and then to ask your agent which pages and database tables anyone could reach without an account.
1,645 Lovable showcase apps, scanned in March 2025
The private-window test on your own dashboard
The grid shows the scan reported for CVE-2025-48757. The dashboard and its rows are invented, illustrative only.
Remove one of the three and the attack has nowhere to go.
OWASP puts prompt injection at the top of its list of security risks for AI applications. The developer Simon Willison describes a "lethal trifecta" of access to your private data, exposure to content from someone else, and a way to send something out, and advises avoiding that combination rather than counting on a filter, because a filter that stops 95% of attacks is, in his words, "very much a failing grade".
For a trading or investing tool, that usually means making a choice. A tool that summarises the news shouldn't also send emails or place orders, and a tool that places orders shouldn't read random web pages to decide what to do next.
Pick a tool, or switch the three legs yourself
After Simon Willison, "The lethal trifecta for AI agents" (16 June 2025). Removing one leg limits data theft through prompt injection; it doesn't prevent every misuse.
A harmless-looking tool can carry instructions you never see.
In April 2025, Invariant Labs showed that the description of an MCP tool can contain instructions that the model reads but the user never sees. In their demonstration, a tool for adding two numbers got the agent to read the user's private SSH key, and a server can also change its tools after you've approved it, which they call a rug pull.
Packages work in a similar way: in a study of 576,000 code samples from 16 language models, 19.7% of the recommended packages didn't exist, and because many invented names come back again and again, an attacker can register them and wait. The same goes for the coding agent itself, which can see your keys unless you keep them out of its folder.
One MCP tool, two views
Illustrative only. The hidden text is paraphrased from the mechanism Invariant Labs described (1 April 2025), not copied from their demonstration.
Your own safety check, in the order that matters for your tool.
Tell the checklist what your tool does and where it runs. It puts the nine questions from the article in order, with what good looks like next to each one, and a stopwatch for the last one.
A starting point for your own check, not a professional security review and not financial, legal or investment advice. Permission names and options differ per broker and exchange.
Your safety check
Nobody else is going to check your tool for you, but luckily it only takes an evening.
Start with what the key allows and end with how fast you can switch it off. This page is for information and education only and is not financial, legal or investment advice.
Every fact on this page, and where it came from.
The facts come from the article and the public research, vendor reports and documentation below, as of 30 October 2026. Most figures come from security vendors with different methods, so they aren't directly comparable. Kraken and Alpaca are examples, not recommendations. The report, the journal test, the private-window test, the trifecta switches and the MCP tool are illustrations. Hello Purple is published by Purple Technology; no Purple product is described on this page.