Chapter 8 · Defence
How YOLO stays safe
This chapter is about other people harming you, rather than about trading risk. Sessions you can see and end, a re-check of who you are before real money is ever enabled, requests bound to your own identity before they reach anything, experts who cannot be impersonated on a messaging channel, and a platform that never holds your money in the first place. It describes posture, not parameters — deliberately.
Pick the thing you are actually worried about.
A list of security features tells you nothing, because you cannot tell which of your fears it answers. So choose a worry instead, and read what stands in the way of exactly that one.
Your account
Your money
The signals you see
The platform
“Someone has my password”
What stands in the wayThree things, none of which depend on you noticing anything.
- In placeChanging your password immediately signs out every other session, everywhere. Someone holding a session they opened with the old password loses it in the same moment.
- In placeA new password is screened against passwords known to have appeared in public breaches — and the password itself never leaves the platform to be screened. Only a short, non-identifying fragment of its fingerprint is used, and the comparison happens here.
- In placePasswords are never stored in a form anyone can read back, including us.
What is deliberately not on this page. No thresholds, no limits, no names of the pieces involved. Everything above describes that a door exists; nothing above describes its lock, and that is not an oversight. If you are a security researcher and you have found something, we would genuinely rather hear from you than not — use the contact route in the footer.
The three ideas underneath all of it
- Fail closed. When the platform cannot work out who sent something, or whether an account is allowed to do something, the answer is no. A defence that quietly gives up under load is not a defence — it is a defence-shaped gap that opens exactly when it is being attacked.
- Make the bad request impossible to phrase. Wherever we can, a dangerous request is rewritten into a safe one before it reaches anything, rather than being caught by a check afterwards. Checks can be forgotten when new code is added; a request that cannot express the attack cannot be forgotten about.
- Your money is not here. It stays in your own broker account throughout. YOLO decides, explains and places — it never holds. That single architectural choice removes an entire category of things that could go wrong.
What YOLO will never ask you for
- Your bank details, card number or any payment credential for trading.
- Your broker password. Connecting a broker uses keys you generate and can revoke there.
- Permission to move money between accounts — there is no such feature.
Security is not the same as safety from loss. Everything on this page is about stopping other people harming you. The trading risk is separate, real, and covered in the safety chapter — a defined maximum loss is still a loss you must be able to afford.