Safety

Only on next.vestmarkets.com. The script says so in its own header, and the app that runs it, Userscripts on an iPhone or Tampermonkey on Android, holds it to that. On an iPhone, Safari also asks you before Userscripts may touch Vest at all. It doesn’t run on any other site, and not inside the frames of a page.

• Through Vest’s own buttons. LONG, SHORT and the rest fill Vest’s own order ticket and press Vest’s own Buy or Sell, the way you would by hand. FLAT, 50% and REV press Vest’s own close buttons. Vest’s page sends every order; the script never puts an order request together itself.
• The same order code as the Chrome extension. The phone build is made from the released extension’s source, and the build stops if its order code differs from the extension’s by a single byte.
• Copy trading uses Vest’s own functions. The copier calls the same order functions Vest’s page uses, so Vest’s code sends each follower’s order.
• Nothing trades by itself unless you turned it on. A trailing stop or Auto BE moves your stop, the copier copies, and the daily loss limit closes your positions, each only after you switch it on. Everything else waits for your finger.

A close or a part close of your account leaves the phone only after your finger asked for it: FLAT, 50%, REV, the row under 50%, LIMIT, LONG or SHORT against your position, or Vest’s own close buttons. The daily loss limit’s close counts too, when you switched it on. Any other close is stopped inside Vest’s own code before its request leaves.

Settings, Phone, What closed my position lists every close that was sent or stopped, and what did it. A close that came from somewhere else, like a copier running on another device, shows as not from this phone.

• It never asks for, reads or keeps your password, and it never signs in or out for you.
• The Calendar and the limits read your own trades and payouts from Vest, with read-only requests and only to a fixed list of Vest’s addresses. For those it uses the session your Vest page already has. That session stays in the page’s memory, is never written down, and goes nowhere but Vest.

• Send your account, your trades, your balances or your login anywhere but Vest.
• Run code it fetches itself. Its version check only reads a version number and a line of text, and the voice it downloads is only ever played as sound.
• Update itself. A new version comes only through the app that runs it, from this site: on an iPhone when you tap Update, on Android when Tampermonkey fetches it.

Exactly what does leave the phone is on the privacy page.

• Read it. The script is plain JavaScript. Open it and every line that runs on your phone is there. The voice is a separate download from this site, sound only, taken only when it matches the fingerprint written in the script. Reading it is allowed; copying or reusing it isn’t.
• Compare it. The install pages and the update page show its SHA-256. For 9.0.5 it is adf3c54f56661e22f88d25cb5b3a8aa2476a86e7fd8000e75e7c6b0aea0d171f.
• The extension it’s built from is on bv.astrals.dev. Every release zip of it is scanned on VirusTotal before I publish it, and the results are in its release notes on GitHub.

Better Vest Mobile is free to use, but it isn’t open source. You can read the code so you can see exactly what runs on your phone; the license says what you may and may not do with it.