Safety
kill switch, PANIC, risk limits, watchdog, audit log.
Tools that stop everything at once, stop trading automatically at a loss limit, tell users when a bot stalls, and record who did what. All of them run on the server.
01Kill switch
On the Home screen: hold the kill switch for a second. It is per user and covers every account.
- Bots cancel their entries and pause; Smart Trades cancel unfilled entries; algo orders stop adding risk. Exits keep running.
- While it is on, only risk-reducing orders pass: spot sells and futures reduce-only orders. Anything else answers
kill_switch_on. - Turn it off on the Home screen to trade again. Bots stay paused until you resume them.
- It can also be turned on from Telegram (
/kill), by the PANIC and by the risk guard. Every change is audited and notified.
02PANIC
Safety, Panic: hold the button to arm it, then type PANIC. Choose the scope (all accounts or one account) and what to do:
| Option | Default | What it does |
|---|---|---|
| Stop bots | On | Stops the bots on the accounts in scope; also pauses copy links into those accounts |
| Cancel open orders | On | Normal, stop and algo orders |
| Close futures positions | On | Reduce-only market orders |
| Sell spot coins bought by bots | Off | Market sells can fill at a bad price in a fast market. Coins you held before stay on the account. |
The kill switch turns on first (always for the whole user, even with one account chosen). Every step is attempted even if an earlier one fails, and a report per account lists what was stopped, closed and cancelled and any errors. Afterwards the kill switch stays on; turn it off yourself. Running it again is harmless. It can run 3 times a minute.
03Risk limits
Safety, Risk limits:
- Max daily loss (quote amount): equity change since 00:00 UTC. When a day-start snapshot is missing, the guard uses net PnL of trades closed today plus open PnL instead, and shows which method it used.
- Max drawdown (%): from the highest hourly equity.
- Auto-panic on a breach: also runs the panic for all accounts (cancel orders, close positions, stop bots; spot coins are not sold).
The guard checks once a minute. A breach acts only when two checks in a row see it: the kill switch turns on, the user is notified and the breach is recorded. Each kind acts at most once per UTC day unless it gets worse by one more limit. Empty = no limit.
The guard cannot see deposits and withdrawals: a transfer out counts as a loss and as drawdown. After a withdrawal, press Reset peak.
04Bot watchdog
Every 60 seconds the watchdog checks every running bot and live Smart Trade and shows a health badge:
| State | Meaning |
|---|---|
| OK | Working normally |
| Stalled | No pass for more than 3 runner intervals while the account is not backing off. The runner is re-scheduled once; if it is still stalled at the next check the user is notified. |
| Degraded | 5 or more failed passes in a row, or a market order open for more than 2 minutes |
| Error | The exchange rejected the key. The account is left alone, probed once every 15 minutes, until the key is rotated. |
When an exchange asks the server to slow down, the account backs off (2 s, 4 s, up to 5 minutes). User actions such as close and stop are never held back. Users get one notification per change and one on recovery. Each account's connection health is shown under Safety, Key safety.
05Audit log
Safety, Audit log: every action on the user's account, from the app, Telegram, the API or the server itself: keys added, rotated or removed, kill switch, Smart Trades, bots, closed positions, close-all, panic, risk settings, algo orders, copy links, two-factor changes, ended sessions, watchdog re-schedules. Each row has the time, the source, the result (ok or failed:<code>) and, for app actions, the client IP.
06Key safety
Safety, Key safety per account: the key's permissions (read, spot, futures, withdraw: refused), the position mode, the server IP to whitelist, the connection health and Rotate key. See Exchange API keys and Security model.