This repository integrates with an unofficial, reverse-engineered Firstrade API client. Treat credentials, cookies, MFA secrets, and debug logs as highly sensitive.
Do not commit:
- Firstrade username or password
- MFA secret, PIN, OTP codes, or recovery material
.runtime/cookie files- raw upstream HTTP request/response logs
- account numbers, balances, positions, or order confirmations
Report vulnerabilities privately through the repository security channel after the repository is published. Until then, keep reports within the QuantStrategyLab maintainer group.