← All education

Security for Traders — Protect the Account, Protect the Edge

Trade what you see, not what you think!

You manage entries, exits, and stops on every trade. Your accounts deserve the same discipline. Most traders who lose money to hackers do not get outsmarted by a genius — they leave a door open: an old API key, a laptop that has not been updated in months, a password reused one time too many. One breach can undo years of careful trading in an afternoon.

This page is the checklist I run on my own setup. Seven areas, a few concrete actions each, no hype. Work through it once, then re-check it the way you re-check a chart — on a schedule.

Listen — Security for Traders, the audio briefings

Prefer to listen? Each briefing below is a short audio lesson built on a real, recent security incident — what actually happened, what is only claimed, and the one practical action that closes the door. Ten lessons, about three minutes each. Work through them in order, or jump to the one you need.

1. Your laptop is the vault door

Everything you own sits behind the machine you trade from. If that machine is compromised, your broker's security does not matter — the attacker is already inside, typing as you. A major crypto exchange lost billions after attackers got into a single engineer's laptop. The vault was fine. The door was not.

• Keep the trading machine updated. Turn on automatic updates for the operating system and the browser, and install them when they land — do not let them sit.
• Run a full antivirus scan on a schedule — weekly, not just the quick scan. The quick scan checks the hallway; the full scan checks the house.
• Keep the trading machine clean. The fewer random programs, downloads, and side projects on it, the fewer doors it has. If you experiment, experiment somewhere else.
• Lock it when you walk away. A screen lock costs you two seconds. An unlocked machine costs whatever is in the accounts.

2. API keys are loaded weapons

If you run bots, scanners, or AI tools against your broker, your API keys can do what your password does — some of them can trade and withdraw. Treat every key like it is loaded, because it is.

• One key pair per bot or tool. When something misbehaves, you revoke that one key and nothing else breaks. One shared key everywhere means one leak compromises everything.
• Delete every key you are not actively using. Old test keys from months ago are open doors you forgot you built. In your broker's API settings, if you cannot say what a key is for, delete it.
• Never paste keys into chats, emails, or documents. Not to a person, not to an AI, not into a support ticket. A key that appears in a transcript or a screenshot is a copied key.
• If a key ever leaks, rotate it immediately — delete the pair and issue a new one. Do not wait to see if anything happens. And where a tool only needs to read, give it a read-only key, never a trading key.

3. Credentials & sessions — the password is only half of it

Attackers steal sessions as often as passwords. A stolen session is a copied login: the thief's browser looks already-signed-in, and changing your password alone does not always throw them out. Patching a hole does not take back the copies that already walked out.

• Use a passkey or an authenticator app for two-factor on your Google account, your email, and your broker. App or passkey beats text-message codes, which can be redirected.
• Unique passwords, kept in a password manager. If one site leaks and you reused that password at your broker, the leak is now a broker problem.
• After ANY scare, sign out all sessions. In Google: your devices and recent sessions — sign out anything you do not recognize, and use "sign out of all devices" when in doubt. Do the same at the broker. Changing the password without killing sessions leaves the copied logins working.
• Review who is signed in, monthly. Two minutes in each account's device list. Anything you cannot name gets signed out.

4. Phishing spikes after breaches

When a platform gets breached, a second wave follows: thousands of phishing emails sent from look-alike — sometimes even real — platform addresses, timed for when you are worried and clicking fast. A real incident this year saw millions of phishing messages ride out on the back of one breach. The alert in your inbox is not always your friend.

• Never act on an emailed "security alert" link. Close the email, open the site or the app yourself, and check there. If the alert is real, it will be waiting for you inside the account.
• Check your Gmail forwarding and filters. Settings → Forwarding: delete any forwarding address you did not add. Settings → Filters: delete any filter you did not create. Attackers use both to quietly copy or hide your mail — including password-reset messages.
• Glance at your Sent folder after any scare. Mail you did not send means the account is being used, not just read.
• Slow down. Every phishing message wants urgency — "act in 24 hours or lose access." Real brokers do not run on panic. Panic is the tell.

5. Third-party tools & extensions — every install is a door

Indicators, browser extensions, scripts, AI tools: each one you install gets some level of access to your machine or your accounts. Most are fine. You only need one bad one. A trojanized AI coding extension recently caught on a marketplace was quietly trying to plant an SSH key on users' machines — a permanent back door, installed by the user, on purpose, because the tool looked useful.

• Audit what you have installed — extensions, tools, scripts — and remove anything you cannot name and explain in one sentence.
• Install only from official sources. "Free premium" versions of paid tools are a classic carrier. If the deal is the tool plus a mystery, the mystery is the product.
• Read the permissions. A simple indicator does not need access to your files, your network, or your other accounts. When a small tool asks for everything, that is your answer.
• Give AI tools the least access that works. Read-only where reading is enough. An assistant that can look at your positions does not automatically need the keys to move them.

6. Backups you have actually tested

Trade journals, bot configs, tax documents, the files your whole operation runs on — if they live in exactly one place, they live on borrowed time. Ransomware, a dead drive, or one bad sync can take them all in the same minute.

• Back up the files that matter on a schedule, automatically if you can. Manual backups get skipped exactly when life gets busy.
• A backup you never restored is a hope, not a backup. Once a month, pick one important file, restore it into a new folder, and open it. If it opens, your backup is real. If it does not, you just learned that while it is still cheap.
• Keep one copy off the machine — cloud storage or a drive that is not plugged in all day. A backup sitting next to the original burns in the same fire.

7. If something goes wrong — the freeze order

In a real scare you will not think clearly, so decide the order now, while you are calm. Print it. Pin it near the desk. When the moment comes, you do not improvise — you follow the list, top to bottom.

1. Email first. Change the Google/email password and sign out all sessions. Email is the master key — every password reset on every account flows through it, so you secure it before anything else.
2. Broker and exchange API keys. Revoke the lot and reissue only what you need. This stops bots and tools from being driven by someone else.
3. Broker and bank passwords — change them and kill the other sessions.
4. Social passwords. Your name and reputation live there; an attacker in your socials can scam your followers in your voice.
5. Tell your people. Broker support, and anyone who might get a message "from you." A two-minute warning kills most impersonation attempts before they start.

None of this makes you untouchable. It makes you a hard target with a plan — and in security, like in trading, the plan is the edge.

Keep learning

Security is one side of trading discipline; the mechanics are the other. Work through the video lessons, or read the free written lessons: the Bull Flag and the Hammer. The books — the free Options Playbook — Starter Edition, the Full Edition ($20), and the 32 Candlestick Patterns collection ($20) — ship with AI study files and the Knight Trader MCP Study Server.