FinceptTerminal: Next-Generation Financial Intelligence Platform

But isn't C++ vulnerable in terms of security...?
I don't understand it well because I don't do serious investing, but does this mean it's okay because it's a tool specialized for analysis?

FinceptTerminal is a modern, open-source financial application developed by Fincept Corporation that provides advanced market analysis, investment research, and economic data tools.

Built as a native desktop application based on C++20 and Qt6, it aims to provide performance comparable to a Bloomberg terminal.

Its greatest features include CFA-level advanced analytical functions, 37 types of AI agents, over 100 data connectors, and real-time trading capabilities integrated with 16 brokers, all within a single binary.

Based on the philosophy that "only thought is the limit, and there are no limits to data," it achieves extremely high processing speeds and a flexible data exploration environment through a pure native implementation that excludes Electron and web-based technologies.

Technical Foundation and Architecture

FinceptTerminal v4 is designed with performance and efficiency as the top priority.

• Core Stack: A pure native application based on C++20. It uses Qt6 for UI and rendering, and incorporates Python as an analysis engine.

• Performance: Since it does not use a JavaScript runtime or browser engine (like Electron), it provides a low-latency operating experience without the overhead typical of web-based applications.

• Build Environment: To ensure stability, the following specific versions are specified.

  • CMake: 3.27.7

  • Qt: 6.8.3

  • Python: 3.11.9

  • Compiler: MSVC 19.38 / GCC 12.3 / Apple Clang 15.0

Key Features and Analytical Capabilities

It is equipped with a wide range of features required by professional investors and financial analysts.

Advanced Analytical Tools

• CFA-level Analysis: DCF models, portfolio optimization, risk metrics (VaR, Sharpe), derivative pricing, etc., can be executed via Python modules.

• QuantLib Suite: Equipped with 18 quantitative analysis modules, including pricing, risk, stochastic analysis, volatility, and fixed-income assets.

• AI Quant Lab: Machine learning models, factor discovery, high-frequency trading (HFT), and trading using reinforcement learning.

AI Agents and Automation

• 37 Specialized Agents: Builds economic and geopolitical frameworks in addition to trader/investor frameworks (Buffett, Graham, Lynch, Munger, Klarman, Marks, etc.).

• Multi-Provider Support: Supports major LLM providers such as OpenAI, Anthropic, Gemini, Groq, DeepSeek, and Ollama, as well as local LLMs.

• Visual Workflow: Building automation pipelines using a node editor.

Data Connectivity and Real-Time Trading

• 100+ Connectors: DBnomics, Polygon, Kraken, Yahoo Finance, FRED, IMF, World Bank, AkShare, government APIs, etc.

• Alternative Data: Integration with Adanos Market Sentiment allows for the analysis of retail market sentiment from Reddit, X (formerly Twitter), financial news, Polymarket, and more.

• Global Intelligence: Maritime tracking, geopolitical analysis, relationship mapping, and satellite data.

• Trading Features: Real-time trading, algorithmic trading, and paper trading through 16 brokers (IBKR, Alpaca, Zerodha, etc.).

Development Roadmap

The platform is scheduled for phased feature expansion.

Timeline Milestone

• Completed Real-time streaming, 16 broker integrations, multi-account trading, PIN authentication

• Q2 2026 Options strategy builder, multi-portfolio management, expansion to 50+ AI agents

• Q3 2026 Programmatic API, machine learning training UI, institutional features

• Future Mobile companion app, cloud synchronization, community marketplace

Licensing Structure and Support for Educational Institutions

FinceptTerminal adopts a dual-licensing model to balance transparency with business use.

• Open Source (AGPL-3.0): Free for personal, educational, and non-commercial use. Code transparency is ensured, but sharing of modifications is mandatory upon distribution.

• Commercial License: Required for business use or if you wish to have commercial access to Fincept Data/API.

• University & Educational Plan: Provides 20 accounts for $799 per month. Includes full access to Fincept Data and API, allowing for the use of CFA curriculum-compliant analytical features in lectures.

Conclusion

FinceptTerminal is an ambitious platform that aims to break the limitations of traditional financial software. By combining the powerful native performance of C++ with the flexible analytical extensibility of Python, it seems to be redefining professional financial analysis as something open and accessible.

...Wouldn't it be better to rebuild this in Rust?
Is it really okay for financial software to have vulnerabilities?

↑ I got curious and looked it up, and it seems that many existing software programs used in the financial sector are abnormally old. So, creating it with C++20... is that really okay?

The 'C' and 'C++' languages, which have been the standard for system development for many years, harbor structural memory management vulnerabilities, posing a serious risk that can trigger major incidents in modern business.

Wait? It has trader features, right?
I feel like security trouble is absolutely going to happen with this.
I really think it should be rebuilt.

Didn't Vercel just have trouble recently?
It's not related to C++, but it's fresh in my ears regarding security.
The following is the content of the Vercel incident.

Potential Environment Variable Leakage at Vercel

This summarizes the potential leakage of environment variables due to unauthorized access to Vercel's internal systems and the countermeasures for it. This incident was not caused by a vulnerability in Vercel itself, but was triggered by a compromise of the third-party AI service 'Context AI'. The OAuth accounts (Google Workspace, etc.) of Vercel employees who used Context AI were hijacked, allowing access to Vercel's internal systems.

The important point is that items not set as 'Sensitive Environment Variables' provided by Vercel may have been subject to leakage. Affected users need to promptly rotate (update) their environment variables and enable the sensitive setting.

Overview and Root Cause of the Incident

This incident occurred as a result of a chain of vulnerabilities in specific services.

Sequence of the Compromise

1. Compromise of Context AI: 'Context AI', a service for AI agents, was compromised.

2. Hijacking of Employee Accounts: The Google Workspace accounts (OAuth integration) of Vercel employees who used the service were compromised.

3. Ripple Effect to Internal Systems: Through the compromised accounts, access was gained to Vercel's internal systems for which the employees had access rights.

4. Access to Environment Variables: As a result, customer environment variables may have been read within the scope accessible by the employees.

Security of the Vercel Platform

According to the official announcement, there was no direct vulnerability in Vercel's hosting service itself. Furthermore, due to Vercel's system design, data for which specific protective measures have been taken remains secure.

Role and Scope of Protection for Sensitive Environment Variables

In this investigation, whether an environment variable is marked as "Sensitive" serves as the critical boundary determining whether or not a leak occurred.

Characteristics of Sensitive Environment Variables

• Unreadable: Once set, the value cannot be read by the user who set it, Vercel employees, or even the Vercel system itself.

• Basis for Security: Due to this design, even if the internal system is compromised as it was in this instance, values marked as sensitive cannot be extracted.

Identification of Risk Targets

• Non-sensitive Environment Variables: Environment variables that do not have the "Sensitive" tag may have been read during this incident.

• Past Settings: Environment variables created more than a year ago are at higher risk because sensitive settings were not the default at the time (or the feature did not exist). In the current version of Vercel, the default for new creations is "Sensitive: On (True)."

Recommended Countermeasures

Users and organizational administrators concerned about leaks must take the following steps.

1. Verification and Rotation of Environment Variables

Check the Vercel dashboard (Settings > Environment Variables) and perform the following actions.

• Check Tags: Verify whether each environment variable has the "Sensitive" tag.

• Execute Rotation: For important variables without the tag (such as API keys), change (rotate) the values to new ones, then re-register them with the sensitive setting enabled.

2. Mandatory Settings at the Organization Level (For Administrators)

As a preventive measure, it is possible to enforce the use of sensitive environment variables for all projects within an organization (Team).

• Configuration Location: Access "Security" settings with administrator privileges and turn on "Enforce Sensitive Environment Variables."

• Effect: This ensures that environment variables created in the future will be forced to have the sensitive setting enabled and cannot be turned off manually.

3. Inventory of Third-Party Integrations

To mitigate the risks associated with the root cause of OAuth integration, it is recommended to revoke unnecessary app integrations from management pages such as Google Workspace.

• Where to check: Check which services each account has granted permissions to via myaccount.google.com/connections or similar pages.

• Action: Remove integrations for services with excessive permissions or old apps that are no longer in use.

Conclusion and Future Outlook

This incident highlights not only the robustness of a single service but also how the security of third-party services used by employees directly impacts the safety of the entire organization. Vercel users should continuously monitor official security bulletins and the latest updates, and in particular, promptly review environment variable settings for older projects.

Checklist and Action Items

• Identify Targets Check if any environment variables in your Vercel projects lack the "Sensitive" tag.

• Immediate Action Rotate (update) the relevant keys and enable sensitive settings.

• Organizational Measures Apply mandatory enforcement of sensitive environment variables by administrators.

• Individual Measures Remove unnecessary apps from OAuth integration pages such as your Google account.

• This information is based on reports available at this time, and it is essential to refer to the latest official information as the situation evolves.