Security

CoinRebalance operates on your Binance account on your behalf. We take that responsibility seriously. Here is exactly what we do — and do not do — to protect your funds and your data.

API key permissions

CoinRebalance requires a Binance API key with Spot Trading and Read permissions only. We explicitly do not request, and you should never grant, Withdrawal or Transfer permissions.

CoinRebalance's internal system allowlist prohibits withdrawal-related API calls entirely. Even if an attacker gained full access to a CoinRebalance account, they could not instruct CoinRebalance to move funds off Binance.

Recommended: Enable IP whitelisting on your Binance API key, restricted to CoinRebalance's executor IP address. This prevents your key from being used from any other location, even if the key is somehow exposed.

How your API secret is stored

Your Binance API secret is encrypted with AES-256-GCM before being written to our database. The encryption key (KEK — key-encrypting key) is stored only on the executor server and is never placed in the same location as the encrypted secrets. The executor server has no inbound network access; it communicates outbound only via a Cloudflare tunnel.

When CoinRebalance needs to sign an API request, the ciphertext is sent to the executor, decrypted in memory, used for signing, and immediately discarded. Your plaintext API secret never passes through Cloudflare Workers or any other intermediary.

Two-factor authentication

TOTP two-factor authentication (compatible with any authenticator app such as Aegis, Google Authenticator, or Authy) is required before you can perform sensitive account actions:

  • Adding or rotating an API key
  • Enabling or disabling auto-trading
  • Revoking consent or changing plan settings

Each TOTP step-up grant is single-use and expires after five minutes. TOTP codes cannot be replayed — used codes are recorded to prevent reuse.

Audit log

Every rebalancing cycle, trade placement, login event, and sensitive account action is written to an append-only audit log. Entries cannot be modified or deleted after creation — this is enforced at the database level with immutability triggers. You can access your complete audit history at any time from your account dashboard.

Sessions and authentication

  • Sessions use opaque 256-bit tokens stored as Secure, HttpOnly, SameSite=Lax cookies
  • Sessions slide to 30 days on activity, with an absolute expiry of 90 days
  • Email OTP codes for sign-in are 6-digit, single-use, and expire after 10 minutes
  • Failed OTP attempts are rate-limited per IP and per email address
  • No enumeration: identical responses for registered and unregistered email addresses

Infrastructure

  • CoinRebalance runs on Cloudflare Workers (edge compute) — no origin server exposed to the public internet
  • The executor VPS has SSH key-only access, a default-deny inbound firewall, and unattended security updates
  • Cloudflare Access protects the admin panel — requires Cloudflare Zero Trust authentication before the app is reachable
  • Database exports are taken nightly to encrypted object storage with 30-day point-in-time recovery