Hi,
Thanks for your messages.
---
It is wonderful to see how technology is advancing and you can literally have “scripts” for everything. It’s like a ready made skeleton and all you need to do is customise it as per your needs and start the entire workflow. GitHub is giving similar ideas and almost every written code is available as open source.
The only concern is how this script will run? You have mentioned all the KYC authenticaties and SMS verifier. How the ownership is transferred for this code considering its gonna fetch and store data for thousands of users in the future. Does it go to your servers and how is safety or data integrity is kept considering it’s a complicated code.
Nice development but script for something related to financial domain is risky bet. Hope to see expert opinions on this.
We understand your concerns. The system does not send any kind of data to our servers other than license check request which only sends the domain, IP, and license number. All other data stays in your system and database. External provider connections like SMS use your account credentials. You can even delete the license checker but it would prevent you from getting the updates and our support.
At the base, it is a PHP script built with the Laravel framework. So if we were to purchase the script, what we would do is investigate the source code with git, staging each file one by one after checking. There are more methods you can use like investigating network traffic, using firewalls, etc.
While we agree with the concerns of users, we also claim that It can be used 100% risk-free by using a couple of methods.
Let's assume that we decided to commit a crime to steal exbita users' funds. You can prevent this easily no matter what we put into code by using many methods. Some of them:
- Use coinpayments for all tokens/coins. This does not even require any edits to the code. You just set this from admin. By using Coinpayments for all deposits and withdrawals, you can turn the hot wallet into a cold wallet managed by Coinpayments. In the Coinpayments system, you have the option to manually approve withdraws so even if your entire system including your Coinpayments API credentials are stolen, there is no way to get any funds out of the system without your manual approval from coinpayments.com.
- Exbita supports cold storage. You can just use the cold storage support and don't keep any funds in the hot wallet other than a small amount to cover transfer fees. When the system receives a withdrawal request that the hot wallet cant cover, exbita will ask you to fund the hot wallet from cold storage to process the withdrawal request. You can set an amount to your hot wallet to send the extra funds to cold storage when a deposit is received.
We did not add any technical solution here, but using some firewall support, it would be impossible to get hacked, no matter what we release in updates. Please contact us for more options on security if you have concerns.
But in the end, the trust issue happens due to being a small company. For example, the Wordpress plugin WooCommerce also deals with financial stuff, collects credit card details, etc, and huge companies use it, We don't think any of them checked the source code for any foul play.
Also, Exbita is a starter, if you can find an opportunity and grow with it, you can hire your dev department, and they can handle the rest.