# Freqtrade Security Audit
**Date:** July 6, 2026
**Status:** 🔴 CRITICAL ISSUES FOUND
---
## Critical Issues (FIX IMMEDIATELY)
### 1. Plaintext API Keys in config.json
**File:** `/home/vincent/freqtrade-user/config.json` (lines 35-37)
```json
"key": "stNFONPNMrmHmUE1zPKfKEIzAlq6I38CehSXhwewqM5e0MjEJq2IGO8Vpj4OfAiM"
"secret": "da6Wu8XJUBrzPggCCCtXspUJKIlXA8ORq4LLpvtwd0KGbRkVqKjN3GGLC1wlCmj2"
```
**Risk:** If this file is committed to git or shared, anyone can access your Kraken account.
**Fix:**
```bash
# 1. Revoke current keys on Kraken immediately
# 2. Generate new API keys
# 3. Use environment variables:
export FREQTRADE__EXCHANGE__KEY="your_new_key"
export FREQTRADE__EXCHANGE__SECRET="your_new_secret"
# 4. Or use freqtrade's credential management
```
### 2. Weak API Server Credentials
**File:** `/home/vincent/freqtrade-user/config.json` (lines 58-66)
```json
"jwt_secret_key": "somethingRandomSomethingRandom123" # Weak
"password": "2ppq6VRS7" # 9 chars, no complexity
```
**Fix:** Generate strong random credentials:
```bash
# Generate JWT secret
python3 -c "import secrets; print(secrets.token_hex(32))"
# Generate password
python3 -c "import secrets; print(secrets.token_urlsafe(24))"
```
### 3. API Server Listening on All Interfaces
**Current:** `"listen_ip_address": "0.0.0.0"`
**Risk:** API accessible from any network interface
**Fix:** `"listen_ip_address": "127.0.0.1"`
---
## Recommended Fixes
### config.json hardening checklist:
- [ ] Revoke and regenerate Kraken API keys
- [ ] Use environment variables for all secrets
- [ ] Change JWT secret to 64+ random hex chars
- [ ] Change API server password to 24+ random chars
- [ ] Bind API server to 127.0.0.1 only
- [ ] Add `config.json` to `.gitignore`
- [ ] Check git history for leaked credentials
### Kraken API key restrictions:
- [ ] API key should have: Trade + Query Only (no Withdraw)
- [ ] Set IP whitelist on Kraken if possible
- [ ] Enable 2FA on Kraken account
---
## Quick Fix Script
```bash
# Generate new secure credentials
JWT_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
API_PASSWORD=$(python3 -c "import secrets; print(secrets.token_urlsafe(24))")
echo "JWT Secret: $JWT_SECRET"
echo "API Password: $API_PASSWORD"
# Update config.json (use jq or manual edit)
# Then add to .bashrc or a .env file:
# export FREQTRADE__EXCHANGE__KEY="new_key"
# export FREQTRADE__EXCHANGE__SECRET="new_secret"
```