Some automated trading apps steal account details or install malware. It makes sense to be cautious with an unfamiliar app. We designed these checks so you can verify it for yourself, even if you aren't technical.
What the app cannot do
Withdraw your assetsCrypto exchanges: Bitget, Bybit. The contract-trading key you create has no withdrawal permission. Futures brokers: Topstep, Lucid, Tradovate, IBKR (unverified). The connection has no withdrawal function at all - money leaves those accounts only through a payout request you make on the broker's own site.
Access your account passwordYour API keys, passwords, and PIN never reach our servers. For NinjaTrader, you sign in directly with NinjaTrader.
Place trades without your knowledgeAnyone can inspect the app's public code to see what it can order and when. The signals it follows are sent identically to every member, and an independent timestamping authority (FreeTSA, RFC 3161) seals the delivery records daily. You can compare the orders in your account with those public records.
Hold or receive your fundsWe never ask you to deposit money or send crypto to a wallet address. Your assets always stay in your own exchange or broker account.
Store your keys unencrypted on diskYour keys are stored in your operating system's secure storage. If that isn't available, they are encrypted with your PIN and never stored as plain text in the config file.
Verify it for yourself
Method 1 - Scan it with 70+ antivirus engines
about 1 minute
Have the installer file ready (do not install it yet).
Go to virustotal.com in your browser.
Click Choose file and upload the installer.
70+ antivirus engines scan it at once. A green 0 means none of them found a threat.
That verdict comes from the antivirus companies, not from us.
Method 2 - Restrict access to trading only
about 3 minutes
Crypto exchanges: Bitget, Bybit. Follow our guide to create a new API key, and leave withdrawals disabled. Grant trading permission only. If withdrawals are enabled, turn them off. The key setup guide explains this for each exchange.
Futures brokers: Topstep/ProjectX, Tradovate, Lucid, IBKR (unverified). These connections don't include withdrawal permissions. ProjectX API keys can place orders and read data. Lucid and Tradovate connect through NinjaTrader 8 and a local bridge on your PC; IBKR connects through TWS on your PC. Withdrawals require a request on the broker's site, which the app cannot make. Our setup guides include the relevant permissions details.
Enter the key or set up the broker connection in the app.
With these permissions, the app can place trades but cannot move your assets. Your broker enforces that limit; you control the broker account.
Check that the file you downloaded matches the hash we published. The download page shows a SHA-256 value; compute it on your own copy and compare. On macOS run shasum -a 256 <file> in Terminal, on Windows run Get-FileHash <file> in PowerShell. If the two match, your file is the file we published.
Hand the code to an AI and ask. Give the repository address to ChatGPT or Claude and ask it to find any way the app could take your keys or move your assets, and to list everything it sends to us.
If you want to go further, build the app yourself from that source and run your build instead of ours. The steps are in the repository README.
Whatever we put in the code, we cannot hide it once the code is public. The verdict is reached by you and by the AI you chose, not by us.
Example prompt to paste into an AI (ChatGPT, Claude)
Please audit this source-available automated trading app for safety: https://github.com/KyowonJeong/eq-autopilot
It runs on my own computer, connects to my broker with an API key, and places trades. Read the code and answer plainly:
1. Can it read, store, or transmit my API keys, password, or account credentials anywhere?
2. Can it withdraw or move my funds, or do anything beyond placing trades?
3. What data leaves my computer, and where does it go? List all of it.
4. Are there backdoors, hidden network calls, obfuscated code, or any signs of malware?
5. If you find nothing harmful, say so clearly. If anything is concerning, quote the exact file and line.
Be skeptical and specific.
Coming soon
SoonVerified-developer signature - we are signing and notarizing the app so your operating system shows us as a verified developer at install.
SoonAn in-app activity view - a live screen showing what the app sends and when.
A straight answer. No software can be guaranteed risk-free, and an AI review is a tool, not a guarantee. Your assets are protected by the permissions in your broker account, not by our word. We cannot move or withdraw your assets. Our only official site is edgequant.app. Sign in and access your dashboard at app.edgequant.app. Watch out for impersonation and check the address before signing in.