Gunbot Live separates public documentation from logged-in bot management. You should treat exchange API keys, bot URLs, passwords, passphrases, wallet details, configuration files, strategy code, and trading history exports as sensitive and avoid sharing raw private data in public support channels.
Public Versus Private
Public pages explain the product and trading automation concepts. Logged-in dashboard routes are for account-specific bot work.
Sensitive Information
Exchange API keys and secrets. Passphrases or passwords. Gunbot URLs and access tokens. Wallet addresses when privacy matters.
Good Operating Habits
You can use least-privilege exchange API permissions. You should rotate compromised credentials. Do not paste raw secrets into chat or screenshots. Verify domains before logging in. You can review connected instances and access regularly.
Public And Private Route Boundaries
Public pages explain the product. Private areas are where connected bot data belongs: dashboard, settings, charts, pairs, copy trading, backtesting, risk review, admin, and API screens should stay behind the right authentication.
Credential Handling
Never paste exchange API keys, secrets, passphrases, passwords, or tokens into public chat. When support needs configuration detail, use a safe config export instead of raw files. Full screenshots can expose pair choices, balances, strategy behavior, URLs, usernames, and wallet details, so crop them before sharing. Rotate credentials after accidental sharing or suspected compromise.
API Key Least-Privilege Guidance
Use the narrowest exchange API permissions that still let the bot do its job. Withdrawal permission should usually stay off. Separate keys for separate bots or environments make cleanup easier, and IP whitelisting is useful when your infrastructure is stable enough for it. After migrations, tests, support sessions, or exchange UI changes, review the keys again and remove anything you no longer need.
Safe Screenshot And Export Checklist
Before sharing screenshots or exports, crop API keys, secrets, passphrases, tokens, bot URLs, unrelated balances, usernames, wallet details, and private strategy code unless support truly needs them. If the issue is about one pair, send pair-specific data instead of a full account export. For configuration problems, prefer a safe config export over raw config files.
What Not To Share In Support
Do not share raw config.js files with secrets, exchange API secrets or passphrases, passwords, 2FA recovery codes, private bot URLs, admin tokens, full trading history when one pair is enough, or custom strategy code you do not want disclosed.
What To Do If Credentials Leak
If credentials leak, disable the exposed exchange API key immediately and check recent account activity, open orders, and bot behavior. Create a new least-privilege key only if the bot still needs access. If login details were exposed, change the password and review 2FA. Remove leaked material where possible and write down what was exposed and when.
Cloud Versus Private Deployment Considerations
Hosted cloud access can be convenient. Private deployment can keep the Gunbot instance behind your own server, VPN, proxy, firewall, or private network. Neither model removes the need for secure credentials, careful permissions, backups, access control, and domain verification.
External references
- Gunbot local bot architecture and privacy context: Official product context for local operation and user-controlled bot infrastructure.
- Binance API key permission fields: Reference for API key permissions, reading access, withdrawal access, and IP restrictions.
- Binance API key safety guidance: Exchange-side guidance on key sharing, permission separation, secure storage, and IP allowlists.
- Binance response guidance for leaked API keys: Reference for disabling or deleting exposed keys and tightening permissions.
- official Gunbot headless mode guide: Official guidance for detached GUI and private server operation.
FAQ
Should I share config.js for support?
Instead of sharing the config file directly, make a safe export in Gunbot Live, which handles removing API keys, secrets, passwords, passphrases, and wallet-sensitive fields.
Does private deployment remove credential risk?
No. Private networking reduces exposure of the bot endpoint, but leaked exchange keys, weak passwords, or unsafe screenshots can still create risk.
What is the safest support export?
A scoped safe export that removes secrets and includes only the configuration or history needed for the issue.
Should API keys have withdrawal permission?
For trading bots, withdrawal permission should usually be disabled when the exchange allows it. You should confirm your own exchange requirements.
Can I share wallet addresses?
Sometimes it is necessary, but wallet addresses can reveal identity or history. Share only when needed and in the right channel.
What if my bot URL was exposed?
Restrict network access, rotate any related tokens or passwords, review logs and settings, and move the bot behind controlled access if possible.
Last updated: