> ## Documentation Index
> Fetch the complete documentation index at: https://sdk.zeustrade.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> Keys, approvals and what the SDK sends where.

* **Keys stay with you.** The SDK signs locally with the key, account or wallet client you pass. Nothing is sent to ZEUS but signed transactions to your RPC and REST or stream requests to the ZEUS API.
* **No telemetry.** The SDK reports nothing about your usage.
* **Approvals are explicit.** `setup.approvePlugins` lets the PositionRouter and the OrderBook act for your wallet through the Router; `setup.approveToken` approves the full amount by default, or the amount you pass.
* **The API key is read only.** It opens `/mm/*` reads, the gateway streams and a higher rate limit. It cannot move funds. The streams send it as a query value because browsers cannot set WebSocket headers; keep it out of logs on your side.
* **Contracts are the GMX v1 design.** Requests are executed by ZEUS keepers at the current oracle price within your slippage limit; a request the keeper cannot execute is cancelled and its collateral returned.

Report a vulnerability through [SECURITY.md](https://github.com/zeustrade/zeus-sdk/blob/main/SECURITY.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.