How these audits are made

Public code, a fixed checklist, and a file-and-line reference behind every verdict. No installs, no execution, no exchange account, no referral links.

What is checked

21 controls in six groups, the same for every bot. The AI group applies only to bots that use a model; for the rest it is marked not applicable.

Size and exposure: Maximum order size, Execution paths that skip the cap, Total exposure and leverage
Brakes and stops: Global circuit breaker, Orphaned stop-loss, Orderly shutdown
Connection and operation: Websocket and data reconnection, Duplicate-process lock, Heartbeat and alerts
Accounting and reconciliation: Position reconciliation with the exchange, Fees and funding in the accounting, Order rejection handling, Auditable log
Security: API key permissions, Secrets handling, Authenticated remote control
AI and learning: The model cannot override the brakes, Model output validation, Learns from its mistakes, Model poisoning, Behavior without model quota or response

Verdict values

Present: The control exists and is enforced on the main execution path.
Partial: It exists but with a gap: wrong unit, one path skipped, only at startup, only in memory.
Absent: Nothing in the code does this.
Not applicable: The bot cannot need it: for example, LLM quota in a bot that uses no model.
Not verified: Could not be established from public code in the time available. The note says why.

How a verdict is produced

The repository is read through the GitHub API at a specific commit, which is recorded on the audit together with the date.
Automated readers (AI agents) follow the checklist and must attach evidence, a path and line or a URL, to every verdict that is not "not applicable". A verdict without evidence is not published.
Nothing is cloned, installed or run, and no exchange key is used. The audit says what the code contains, not how it performs.
Repository facts (stars, issues, last push, license) come from the GitHub API and are refreshed when the site is regenerated.

What this is not

Not a ranking. Bots are listed by public data, not by payment, and there are no affiliate links on this site.
Not an endorsement. A bot with every control present can still lose money; the controls decide how much a failure costs, not whether the strategy works.
Not financial advice, and not a substitute for reading the code yourself before connecting a live key.

Disputes and corrections: hello@saasfactoryagents.com. Maintainers who fix a control can ask for a re-audit at the new commit.