Bot security starts with the permission the key lacks
Security on Captay starts from a refusal. The service is not designed to take custody. A future connection would use an API key you create on the exchange, with trading enabled and withdrawal disabled. This page is specific about that plan and equally specific about what is absent: no key is stored here, no review has been commissioned, and no exchange has endorsed the product.
What the key would be allowed to do
Read balances and open orders. Place and cancel spot orders inside the limits. That is enough power to lose a large part of an account, because buying a collapsing market is not a withdrawal. The interesting boundary is the one the key does not have: it cannot request a transfer to an external address, and it cannot sweep to another account inside the venue if that permission is a separate switch and you leave it off.
Exchanges name these switches differently. Captay will not publish a screenshot of a partner console, because there is no partnership to illustrate. When a cabinet exists, the setup notes would have to be checked against the live permission screen, not against this paragraph. Until then, the safe assumption is that you create nothing.
What a bug still cannot invent
If the key was created without withdrawal, a faulty release cannot add that bit. It can still mis-size an order, duplicate a send, or fail to cancel. Those are trading faults, and they are why the outer limits and the halt exist in the design. They are not a certification that the faults have been hunted. No external audit is claimed, and none should be inferred from the tone of a security page.
Planned controls that are not live
- A second factor on the cabinet login, so a stolen password is not a stolen key.
- An activity journal of arm, disarm, limit hits, and key changes, written so it can be read later.
- A recommendation, not a control Captay can enforce, that you restrict the key by IP if the exchange offers it.
- Encryption for stored keys, described in the privacy note as a later plan, not as a present vault.
Two-factor authentication and the journal are product intentions. They are not features you can turn on. There is no login. The activity list is empty because the cabinet has never accepted a session. Saying they are 'planned' is not a date and not a promise they will ship unchanged.
This website does not ask for a key, a seed phrase, or a one-time code. If a form on Captay ever grows a field for those, treat it as hostile. The only form published now checks an email address locally and does not submit it.