Tracking down why brokerage API login kept failing led to a near-miss information leak that never actually shipped, plus a new buffer rule for how stocks enter and leave the trading universe
This is the English version of a post originally written in Korean for my algorithmic trading system devlog(new tab).
Brokerage API login on the paper-trading account had been failing with the same error every round.
At first it looked like a missing config file. But checking further, the live account showed the exact same symptom. Both accounts failing the same way meant this wasn't a missing config — it was something more fundamental.
The cause turned out to be execution order. One entry point never called the code that loads environment variables from the .env file. By the time the auth library's function that reads account credentials ran, the values were already locked in as empty. A similar bug had bitten a different entry point before; this time it resurfaced in a new one.
The fix was adding the environment-loading call at the top of that entry point.
A leak risk found while fixing the bug
There's a reason I didn't stop at just fixing the ordering bug.
Login had never once succeeded before, so this had gone unnoticed: the auth library prints the account ID in plaintext the moment login succeeds. That had caused an incident once before, and a filter was built afterward to strip that output from logs.
The problem: the entry point I'd just fixed didn't have that filter wired in. If I'd shipped the ordering fix alone, the very first successful login would have written the account ID straight into the logs.
I wired the filter into the same commit. Testing in isolation confirmed the login-related log lines were fully suppressed.
Both fixes shipped this evening. Final confirmation comes tomorrow morning, when the first trading round should show a clean login.
A buffer for the trading universe's boundary
Separately, I added a buffer rule to the logic that picks the top-N stocks by market cap as the trading universe.
Previously, every refresh just swapped in whatever the raw ranking said. That meant a stock sitting right at the boundary could flip in and out of the universe on tiny rank swings — and each flip is unnecessary turnover.
The fix: stocks already in the universe stay in as long as they don't fall too far past the cutoff, and new stocks only get added once they've clearly climbed past it. The total slot count itself didn't change, so the universe size stays fixed.
This shipped today for both the KOSPI and KOSDAQ universes, with regression tests passing and the state file confirmed to be generating correctly. Since it just went live, no actual entries or exits have happened yet — I'll get to see the buffer do its job the next time rankings jitter near the boundary.
Also today
Last night's GPU-detection failure, which caused three back-to-back failures, resolved cleanly: the restarted job finished a full ten-plus-hour analysis run early this morning with no recurrence.
Top comments (0)