I’ve been building DepthSight for the past year - a self-hosted algorithmic trading platform that you run entirely on your own hardware, so your API keys and trading logic never touch a third-party server (like 3Commas or Veles).
Instead of writing code, it features a drag-and-drop node editor (40+ logic blocks) where you can build complex strategies, cross-reference indicators, and manage risk dynamically. It also includes an AI assistant that can generate strategy structures from text prompts or even screenshots of chart setups.
Since Lemmy is built on federation, I thought you guys might appreciate the architecture: DepthSight nodes can opt-in to connect to a central Federation Hub. This creates a community network where self-hosted nodes can share verified strategy templates, discuss trading ideas, and form a global node topology map.
Features out of the box:
- Visual strategy builder
- Federation Hub
- Dual backtesting engines
- Dynamic risk management that adapts per trading pair
- Multi-tenant support (JWT, Redis quotas) if you want to host it for others
Stack: FastAPI, Celery, Redis, PostgreSQL, React (with a mobile-optimized PWA). AGPLv3 licensed. Runs with a single deployment script (curl | bash).
Github: https://github.com/DepthSight-Pro/DepthSight
Built this solo (heavily leveraging LLMs for the heavy lifting in code generation). Would love to get some feedback from the self-hosted community, especially on the architecture or features you’d want to see added!
Except you use JWT’s for auth, which is idiotic and a security nightmare. No enterprise that cares about security would ever accept this.
More info: https://gist.github.com/samsch/0d1f3d3b4745d778f78b230cf6061452
There are other problems, some of which I can see… and some of which I can’t. The problem is that I am not a comprehensive expert, I can only spot a few things here and there. Even if I was an expert, why would I audit your software for free lmao? Pay me for that shit.
What I do know, is that vibecoded apps are bad at security. Many, many vibecoded apps have been hit by horrific security bugs like remote code execution, xss, or authentication bypasses. That shit is simply unacceptable and should be extremely rare in modern apps. The fact that I’m not skilled enough to find them reliably makes me even more cautious and concerned around apps like yours.
It’s not just about the app architecture, but also about you. When a known community figure creates an app, I have confidence that they will have a good security posture and architecture. With vibecoding… not so much.
Nice bait, but the problem is this: Just because you get people to
audit“critique” your software, doesn’t fix the root cause of those problems — you. Just because you manage to re-vibecode the app to not use JWT’s or to fix any other number of issues someone would point out, doesn’t actually mean more issues exist that that person missed. Like if someone specialized in python, then they might miss database issues, and so on. The second problem is that inevitably, you will expand this software, adding more features… and vulnerabilities. That is to say, even if you manage to fix the architecture and security now, you have not demonstrated the requisite skill needed in order to keep it fixed.