Release integrity
The prepared Windows and unchanged Android file sizes and SHA-256 values matched their release manifests on 23 August 2026.
Trust Center
Evidence before assurance.
This page separates verified controls, documented design decisions, and unresolved risks. It does not promise that software, markets, networks, or exchanges are failure-free.
Assurance status
Current evidence, stated without overclaiming.
Internal maintainer review
A project-maintainer review covers the controls listed below. It is not an independent security audit.
Exchange approval
No current release is represented as audited, approved, sponsored, or endorsed by KuCoin, Gate.io, or Bybit.
BOVO-IR-2026-08-23-01
Scope-limited internal maintainer review
Review date: 23 August 2026. Scope: the public website delivery controls, guarded download endpoint, direct-binary blocking, release manifests, public Windows archive structure and public profile, Android release metadata, documentation claims, and exchange-independence disclosures for BOVOBot Community Edition.
Classification: Internal and scope-limited. Not independent, not a penetration test, and not an exchange audit.
Evidence checked
- Windows release 0.1.0.38: package size 67,434,976 bytes and SHA-256 matched the public manifest.
- The Windows archive contained one public entry, BOVOBot.exe, and no separate key, settings, database, or credential file.
- Android release 1.6.1: package size and SHA-256 matched the public manifest.
- The download endpoint restricts file selection to manifest-controlled basenames and rechecks SHA-256 before streaming a file. Direct ZIP, APK and EXE requests under the download directory are denied.
- The website applies a restrictive Content Security Policy, clickjacking protection, MIME sniffing protection, and no external analytics runtime.
- Public claims were checked to distinguish product documentation from exchange approval and internal review from independent audit.
Release identifiers
- Windows version
- 0.1.0.38 Community Edition
- Windows SHA-256
5076523C8064EA299756FF859BAE75B706A1416C8FE9CC24E56C315C08D5BAF9- Android version
- 1.6.1
- Android SHA-256
DF60B6A689928CCC267C717B3734F5E39F8E2E556C5C9AA8E676280C0B3825A9- Machine-readable record
- trust.json · releases/latest.json
Documented security model
- BOVOBot runs on the user-controlled Windows system and does not provide custody of funds.
- Users are instructed to create a dedicated API key and keep withdrawal permission disabled.
- The public Windows release contains Standard Futures only. Lead Trade, account binding, broker attribution and bundled exchange credentials are absent.
- Obfuscation and compilation can increase reverse-engineering effort, but they do not make software impossible to inspect or compromise.
- The authoritative position and order state remains the state shown directly by the exchange.
Known limitations and residual risk
No independent third-party security audit or public exchange audit has been completed for the current release. The internal review did not prove the absence of embedded defects, logic errors, credential exposure under every operating-system condition, exchange-side failures, slippage, liquidation, or market loss. Futures and automation remain high risk.
Exchange relationship
BOVOBot is an independent software integration that uses documented exchange interfaces. KuCoin, Gate.io, and Bybit do not operate or publish this website. No audit, approval, sponsorship, certification, or endorsement by an exchange is claimed unless a future page links to a written statement from that exchange.
Responsible security reporting
Report a suspected vulnerability to info@bovotrade.com. Include the affected version, operating system, reproducible steps, and impact. Never send live API keys, secrets, passphrases, passwords, UIDs, seed phrases, or account exports.
Last reviewed
23 August 2026 · 2026 年 8 月 23 日