Greed Terminal

1. Sign-in is a passkey

There is no password to leak and no email to phish. Your account is a passkey (WebAuthn, user verification required) stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or a hardware security key. We store its public key.

The same passkey also unlocks your vault. Through the WebAuthn PRF extension your authenticator derives a secret from a fixed input. Only that passkey can compute it, it is computed on your device, and it is never sent to us. Without it the vault can't be opened, by you or by us.

2. The key hierarchy

  your passkey (Face ID / Touch ID / security key)
        │  WebAuthn PRF extension: a secret only this passkey can produce,
        │  computed on your device, never sent to us
        ▼
  wrapping key ── HKDF-SHA256
        │  decrypts (AES-256-GCM)
        ▼
  vault key ───── random 256-bit key, created in your browser at sign-up
        │                      stored by us only in wrapped (encrypted) form
        ├── HKDF ──▶ item key   encrypts your exchange credentials (browser only)
        └── HKDF ──▶ cache key  encrypts cached exchange data (sent per request)

Every ciphertext is bound to your account and to its slot through AES-GCM additional data, so blobs can't be swapped between users or items. Unlocking happens in the tab; the vault locks itself after 15 minutes of inactivity, when you click Lock, or when you close the tab.

3. What happens on every exchange request

  browser               Cloudflare          terminal.greed.bot relay           exchange
  ───────               ──────────          ────────────────────────           ────────
  decrypt credentials
  with item key
        │  TLS 1.2+     CDN / DDoS edge     in memory only:
        ├─────────────▶ re-encrypts ──TLS─▶ sign request with your key ──────▶ Kalshi
        │  credentials  to our origin       (fixed hosts, fixed endpoints)     Gemini
        │  + cache key                                                         Polymarket
        │                                   encrypt the response with
        │                                   your cache key, store ciphertext
        │◀─────────────────────────────────  return positions
  render portfolio                          drop credentials + cache key

Exchanges authenticate with request signatures that need your secret, and order entry needs the same credential, so every exchange call goes through one path: cleartext in flight only. The relay:

• only talks to fixed exchange hosts and endpoints; it never fetches a URL you (or anyone) supply;
• logs only method, path, status and latency, never headers, bodies or query strings;
• never writes a credential to the database, a file or a log; it is gone when the request ends;
• sends all exchange traffic from one static egress IP, 136.90.85.84. Add it to your key's IP allowlist where the exchange supports it.

4. Cached exchange data follows the same rule

To keep the terminal fast and stay inside exchange rate limits, the latest snapshot of each account is cached for up to 24 hours. Your browser sends the cache key alongside the credential. The relay derives an encryption key and an HMAC key from it, stores the snapshot as AES-256-GCM ciphertext, and indexes it by an HMAC of the account ID. Without your cache key we can't read a cached snapshot or tell which account it belongs to.

5. What our database actually contains

"Delete account" removes all of it immediately.

6. What this design can't protect you from

• A compromised relay or front end. We serve the JavaScript that unlocks your vault, and the relay sees credentials while a request is in flight. If our servers were compromised, an attacker could capture keys from requests made while they were in control. Encryption at rest protects you from database leaks and backups. It doesn't protect you from a live compromise of the running service.
• Our CDN. terminal.greed.bot is served through Cloudflare for DDoS protection. Like every Cloudflare-proxied site, Cloudflare terminates your TLS connection at its edge and re-encrypts it to our servers, so it handles your requests (including credentials in flight) and serves our JavaScript. Our servers accept traffic only from Cloudflare, and Cloudflare stores none of it. Trusting Greed Terminal therefore also means trusting Cloudflare.
• Over-privileged keys. Create a dedicated key per exchange with the narrowest permissions that work, restrict it to our egress IP where supported, and revoke it at the exchange any time.
• Losing your passkey. There is no recovery: we can't decrypt your vault. Use a synced passkey provider. If you do lose it, create a new account and re-add your keys; it takes a minute.

7. Connecting exchanges

Requirements

A current browser and a passkey provider that supports the WebAuthn PRF extension: iCloud Keychain (iOS / macOS 18+), Google Password Manager (Chrome), 1Password, Bitwarden, or a FIDO2 security key with hmac-secret. Older browsers are intentionally unsupported.

Open Terminal →