security: harden trading pipeline and fail-closed risk controls

Author: Ashutosh0x

.env.example

@@ -55,7 +55,16 @@ USE_MOCK=0
 # --- Solana Execution [OPTIONAL] ---
 # Only needed if using the Solana relay/execution features
 # Base58 encoded private key
-SOL_PRIVATE_KEY=IMIT=0.02
+SOL_PRIVATE_KEY=
+
+# --- Trading safety defaults ---
+# Use fractions for risk limits: 0.05 = 5%.
+MAX_DRAWDOWN_PCT=0.05
+MAX_ORDER_NOTIONAL=25000
+ALLOW_MARKET_ORDERS=false
+ALLOW_EXECUTOR_FALLBACK_TO_MOCK=false
+ALPACA_LIVE_TRADING=false
+EVENT_BUS_ALLOW_CONTROL=false
 
 # ============================================================
 # POLYMARKET CONFIGURATION

Cargo.lock

@@ -1,7 +1,8 @@
 use serde::{Deserialize, Serialize};
+use std::fmt;
 use tracing::warn;
 
-#[derive(Debug, Serialize, Deserialize, Clone)]
+#[derive(Serialize, Deserialize, Clone)]
 pub struct AppConfig {
     // Required keys
     pub finnhub_api_key: String,
@@ -25,6 +26,37 @@ pub struct AppConfig {
     pub rust_log: String,
 }
 
+impl fmt::Debug for AppConfig {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("AppConfig")
+            .field("finnhub_api_key", &redact(&self.finnhub_api_key))
+            .field("alpaca_api_key", &redact(&self.alpaca_api_key))
+            .field("alpaca_secret_key", &"<redacted>")
+            .field(
+                "anthropic_api_key",
+                &self.anthropic_api_key.as_ref().map(|k| redact(k)),
+            )
+            .field(
+                "sol_private_key",
+                &self.sol_private_key.as_ref().map(|_| "<redacted>"),
+            )
+            .field("use_mock", &self.use_mock)
+            .field("alpaca_base_url", &self.alpaca_base_url)
+            .field("rust_log", &self.rust_log)
+            .finish()
+    }
+}
+
+fn redact(value: &str) -> String {
+    let trimmed = value.trim();
+    if trimmed.len() <= 4 {
+        "<redacted>".to_string()
+    } else {
+        let prefix: String = trimmed.chars().take(4).collect();
+        format!("{}...<redacted>", prefix)
+    }
+}
+
 fn default_use_mock() -> String {
     "0".to_string()
 }
@@ -57,6 +89,9 @@ impl AppConfig {
             if self.alpaca_api_key.trim().is_empty() {
                 return Err("ALPACA_API_KEY cannot be empty when USE_MOCK=0".into());
             }
+            if self.alpaca_secret_key.trim().is_empty() {
+                return Err("ALPACA_SECRET_KEY cannot be empty when USE_MOCK=0".into());
+            }
         }
 
         if !self.alpaca_base_url.starts_with("http") {