1. Verify the software source
Check the repository, version history, official releases, and any published integrity-verification steps. A publicly visible repository does not mean the full proprietary program or strategy is open source; verify the actual licensing terms.
2. Understand custody and credentials
Find out where private keys and API credentials are stored, where signing occurs, and who can access the dashboard. Self-hosting does not remove the risk of compromised devices, broad permissions, unintended orders, or lost backups. Never share seed phrases or secret keys.
3. Separate backtests, paper and live fills
These are three different evidence categories. Win rate must be considered alongside executable prices, fees, slippage, trade frequency, drawdown, and actual fill records. One screenshot is not long-term profitability evidence.
4. Review failures and exit procedures
Ask what happens after a network outage, restart, update, or shutdown. External orders and positions must be checked independently; closing a browser does not necessarily cancel orders.
5. Check eligibility and endorsement
Independent bots are not official Polymarket products. Verify your own eligibility to access the market and be cautious about any tool claiming to bypass account or geographic restrictions.
The takeaway
Trust requires verifiable facts about provenance, permissions, evidence quality, failure modes, and risk—not just a headline statistic.
For technical education only, not financial advice. Confirm exact features and requirements in the latest software release and project documentation.