# Security

- Do not commit Telegram tokens, executor tokens, API keys, or wallet secrets.
- Default `TRADING_MODE` must remain `paper` until live executor is tested.
- Live trading should be isolated in a dedicated executor service.
- Executor must enforce max trade size, allowlist chains, slippage cap, and audit logs.
- Telegram bot only creates preview and confirmation flow.
- Error messages must be safe and avoid provider internals.
- Meme coin warnings must remain visible in analysis and trade preview.