Your exchange keys
Autoview places trades through an API key you create on your own exchange. How that key is stored depends on where you run Autoview.
- Cloud webhook platform. Your key is stored on our side so trades can run while your computer is off. Each saved key is encrypted with AES under its own random key and IV before it is written, and it is decrypted only when a trade needs it. Encryption at rest is not a promise that a stored key would stay safe in any breach of our systems, so the permissions you give the key matter most.
- Chrome extension. Your key stays in the extension's storage on your computer. It is not sent to Autoview's servers. If you connect the extension to your Autoview.com account, it can record your trade results there for your portfolio view. You can turn that off in the extension's Settings.
Either way, you choose what the key can do. Give it trade and read permission only. Autoview never needs withdrawal permission to place trades. If your exchange offers IP whitelisting, lock the key to your zone's address. If you think a key has leaked, delete it on the exchange first, which shuts it off everywhere at once.
The full walkthrough, with the IP addresses to whitelist, is in Are my API keys safe? For the browser side, see Extension security.
Reporting a vulnerability
If you believe you've found a security vulnerability in Autoview, we want to hear from you. Please report it privately rather than opening a public issue or posting about it before we've had a chance to respond.
Email security@autoview.com with a description of the issue, the steps to reproduce it, and its potential impact. We'll acknowledge your report and follow up as we investigate.
Our full policy is also published machine-readable at /.well-known/security.txt, per RFC 9116.
Safe harbor
We consider security research conducted under this policy to be authorized. We will not pursue legal action against, or refer to law enforcement, anyone who makes a good-faith effort to comply with it. This includes avoiding privacy violations, service disruption, and destruction of data, and reporting findings to us before disclosing them to anyone else.
In scope
- autoview.com, this website and the account application (including MCP tokens under
/account/tokens/) - api.autoview.com, the API used by the browser extension and account application
- The Autoview browser extension for Chrome
- Our webhook/IPN receivers, e.g.
/ipn/pwp/and/ipn/klaviyo/
Out of scope
These hosts and services are either redirect-only entry points into the same worker above, or third-party services we don't operate. Please report issues with them directly to their own owner, not to us.
- use.autoview.com, help.autoview.com, articles.autoview.com: legacy domains that only 301-redirect into autoview.com; there is nothing served here beyond the redirect itself
- status.autoview.com: our status page, hosted by our uptime-monitoring vendor
- pay.with.pink: our payment processor. It shares a developer with Autoview but is a separate service operated independently; please report issues with it to its own operator, not to us
- Klaviyo, Twilio, Mailgun, Partnero, Calendly, and Cloudflare: third-party vendors we use; please report issues with their platforms directly to them
- Denial-of-service, spam, or social-engineering reports against any Autoview staff or user
Hall of fame
We're grateful to the researchers who've reported issues responsibly. See our hallway.txt for the list.