您处于离线状态 — 显示缓存数据
BibaMoney TVIJO AIOS NETWORK
试用GOGA演示
BTC $63445.00 ▼-2.80% ETH $1874.90 ▼-4.50% USDT $1.00 ▲+0.00% BNB $566.53 ▼-1.20% USDC $1.00 ▲+0.00% XRP $1.05 ▼-5.10% SOL $73.17 ▼-4.40% TRX $0.33 ▼-1.60% FIGR_HELOC $1.03 ▲+0.20% WBT $55.43 ▼-3.20% HYPE $54.49 ▼-9.80% DOGE $0.07 ▼-3.80%

Live security feed + exchange risk lab

Security Alerts & Exchange Risk Lab

Tvijo AIOS relays security advisories and turns them into practical risk signals for crypto users: scams, exchange failures, copytrading drift, bot drawdowns, and high-leverage liquidation traps.

MEXC Gate.io Bybit OKX Copytrading x100 / x200 / x500

每5分钟自动刷新。尚无区块链RPC调用；链上异常为占位符。

Wondering how the platform itself is secured? Read our Platform Security statement.

警报
60
Critical
13
高
47
来源
2
受影响的初创公司
0

Exchange Risk Radar

User protection layer

Why deposits disappear

Most losses are not hacks. They are missing limits.

This risk lens follows the failure modes users actually meet on exchanges: copied traders changing risk, bots averaging into liquidation, API keys with too much power, and leverage bands where a tiny move can erase margin.

View loss scenarios Live alerts
Bybit Copytrading drift Follower entry price, margin mode, and master-trader hedge can diverge.
OKX Bot guardrails Grid/DCA bots need hard daily loss caps, position caps, and kill switches.
Gate.io Listing and liquidity risk Thin books, delistings, and transfer network mistakes can trap capital.
MEXC Extreme leverage Very high leverage turns normal volatility, fees, and slippage into liquidation.

Deposit Loss Map

Educational risk model, separate from the live alert counters below.
跟单交易

Follower risk is not master risk

Users can enter later, receive different fills, copy a larger effective position, or miss the master trader's hedge. A profitable leader can still liquidate followers.

  • Show copied leverage before follow.
  • Block martingale-style size jumps.
  • Stop copying when drawdown exceeds the user's cap.
Exchange bots

Automation without a hard stop drains slowly, then suddenly

Grid, DCA, and signal bots can keep adding exposure after the thesis breaks. Without loss limits, one bad regime can consume the full deposit.

  • No withdrawal permission on API keys.
  • Daily loss, max orders, and max notional ceilings.
  • Emergency pause after repeated failed exits.
High leverage

x100 / x200 / x500 is a liquidation product

At extreme leverage, ordinary candle noise, funding, spread, and liquidation fees can erase margin before a human has time to react.

  • Default to low leverage; require friction above the cap.
  • Separate isolated margin from cross-collateral.
  • Show liquidation distance in price, not only percent.
Operational risk

The loss can start outside the trade

Wrong deposit networks, fake support links, compromised sessions, stale API keys, delistings, or disabled withdrawals can convert a normal action into a capital lock.

  • Warn before network and memo mismatches.
  • Score exchange incidents and withdrawal friction.
  • Surface phishing and support impersonation alerts.

Guardrails the Lab Should Enforce

AIOS / GOGA roadmap
Risk budget first Position size, max daily loss, max open orders, and exchange exposure are set before any bot or copy strategy can run.
API permissions audit Trade-only keys are isolated per exchange. Withdrawal rights, stale keys, and broad account scopes are treated as critical risk.
Leverage ceiling Strategies are blocked or downgraded when leverage, liquidation distance, or cross-margin exposure breaks the user's safety profile.
Copytrader drift check Follower fills, master leverage, drawdown, symbol changes, and hidden averaging are monitored as live risk, not marketing performance.

AIOS / GOGA / Admin Connection

How public warnings connect to the product stack.
Public /security Live advisories, token checks, wallet screening, exchange risk education, and user-facing warnings.
GOGA 实验室 Strategy safety scoring, bot drawdown simulation, copytrading anomaly review, and liquidation-distance analysis.
Admin App Collector health, cron status, provider failures, source freshness, risk taxonomy, and release readiness.

Filter the feed

Feed updated 1h ago
全部 critical · 13 high · 47 scam · 1 vulnerability · 56 breach · 3

Sources in this snapshot: hn (46), github_security (14). Counts are computed from the live normalized feed only — nothing is hand-curated.

活跃警报

严重 vulnerability github_security 3天前

Shescape: Shell injection via unescaped parentheses on Windows with CMD

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs. An attacker may be able to achieve shell injection depending on the original command. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }; // 2. Payload const payload = "x) else if a==a (echo y"; // 3. Usage const shescape = new Shescape(options); let escapedPayload; escapedPayload = shescape.escape(payload); // Or escapedPayload = shescape.escapeAll([payload]); // And (example) const result = cp.execSync(`if defined FALSY (echo ${escapedPayload})`, options); // 4. Impact console.log(result.toString()); // Outputs "y" instead of "" ``` ### Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If yo

严重 vulnerability github_security 3天前

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (`src/sm2/utils.js`: `const rng = new SecureRandom()`). `SecureRandom` is jsbn's PRNG, which seeds an **ARC4** stream from `window.crypto.getRandomValues` when available. **In Node.js — sm-crypto's primary runtime — `window` is `undefined`, so the CSPRNG branch is skipped** and the seed pool is instead filled from `Math.random()` (V8 `xorshift128+`, recoverable from a few outputs) plus `new Date().getTime()` (wall clock, attacker-estimable). Node *does* expose Web Crypto as `globalThis.crypto`, but jsbn checks `window.crypto`, not `globalThis.crypto`, so the secure path is never taken. Consequently every SM2 private key produced by the default `sm2.generateKeyPairHex()` and every signing ephemeral scalar is derived from non-cryptographic sources and is **predictable** by an attacker who can observe a f

诈骗警告

代币安全检查

GoPlus 代币风险快照，用于合约级别检查：蜜罐、代理、铸币权限、所有权变更。

粘贴代币合约地址以获取最新的标准化风险快照。

制裁检查

OpenSanctions 钱包筛查，针对制裁数据集。此为公共只读转发，非合规决策引擎。

粘贴钱包地址以运行缓存/实时筛查转发。

近期漏洞

严重 vulnerability github_security 3天前

Shescape: Shell injection via unescaped parentheses on Windows with CMD

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs. An attacker may be able to achieve shell injection depending on the original command. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }; // 2. Payload const payload = "x) else if a==a (echo y"; // 3. Usage const shescape = new Shescape(options); let escapedPayload; escapedPayload = shescape.escape(payload); // Or escapedPayload = shescape.escapeAll([payload]); // And (example) const result = cp.execSync(`if defined FALSY (echo ${escapedPayload})`, options); // 4. Impact console.log(result.toString()); // Outputs "y" instead of "" ``` ### Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If yo

严重 vulnerability github_security 3天前

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (`src/sm2/utils.js`: `const rng = new SecureRandom()`). `SecureRandom` is jsbn's PRNG, which seeds an **ARC4** stream from `window.crypto.getRandomValues` when available. **In Node.js — sm-crypto's primary runtime — `window` is `undefined`, so the CSPRNG branch is skipped** and the seed pool is instead filled from `Math.random()` (V8 `xorshift128+`, recoverable from a few outputs) plus `new Date().getTime()` (wall clock, attacker-estimable). Node *does* expose Web Crypto as `globalThis.crypto`, but jsbn checks `window.crypto`, not `globalThis.crypto`, so the secure path is never taken. Consequently every SM2 private key produced by the default `sm2.generateKeyPairHex()` and every signing ephemeral scalar is derived from non-cryptographic sources and is **predictable** by an attacker who can observe a f

严重 vulnerability github_security 3天前

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

### Summary `ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. ### Details `ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving: ```go // openapi3filter/validation_handler.go:47-49 if h.AuthenticationFunc == nil { h.AuthenticationFunc = N

HN 安全摘要

该平台如何确保安全

此页面跟踪外部市场威胁。关于BibaMoney / Tvijo AIOS本身的保护措施，请阅读完整声明：

  • 非托管：不持有资金，无法提取资金，永远如此。
  • 交易所密钥使用AES-256-GCM加密；故障关闭保险库，从不显示或记录。
  • 只读公共表面：从公共页面到数据库没有写入路径。
  • 严格CSP（无内联脚本），点击劫持和MIME嗅探保护。
平台安全声明

近期诈骗报告

Chainabuse/滥用报告标准化尚未接入此公共界面。一旦收集器部署，此部分应列出新标记的钱包和活动说明。