Core model
Private keys and provider credentials remain in the operator’s environment. Dry-run is the default in the public repository. Use a dedicated wallet with limited funds — never your primary cold wallet.
- Credential material: local encrypted vault, at rest, operator-held key.
- Control panels: loopback or a private network, never public exposure.
- Default posture: observe and simulate; execution is an opt-in.
Responsible disclosure
Do not publish an exploitable issue before maintainers can investigate. Contact @girasolsupportbot or the official @girasolbot account with a minimal non-destructive report.
Never send private keys, seed phrases or live API secrets — not to support, not to anyone.
Official software
Use only links from this domain and github.com/girasolbot/girasolbot. Verify release notes and checksums when release artifacts become available.
Mirrors, re-uploads and “improved forks” carrying the Girasol name are not maintained here and should be treated as untrusted.
Safe deployment checklist
- Run in dry-run until behaviour is fully validated on your own endpoints.
- Fund a dedicated hot wallet with only your committed balance.
- Set explicit priority-fee budgets — no bare “max” values.
- Enable hard daily loss and volume limits before the first live run.
- Rotate any credential that has ever left your vault, even briefly.
- Review configuration before every mode change; keep a change log.
Incident response
If key material leaks: move remaining funds immediately, revoke provider sessions, rotate every credential, then report through official channels with a timeline. Speed matters more than completeness in the first minutes.