The ticket routes to MetaTrader 5 through every guardrail, but refuses live accounts. Opening that up is a decision we have not taken yet, and it will come with its own safeguards.
What shipped, and what does not work yet.
Two lists. The first is what went live and when. The second is what is missing, broken or deliberately limited, because a product page without one is either perfect or lying.
Shipped
23 September 2026
- Two-step verification (TOTP). Turn it on from Settings, My account.
- Removed three claims the code did not back: two-factor authentication, broker connection limits per plan, and a privacy policy that placed the database in the EU when it runs in Tokyo.
- The Tradovate copier now refuses any link touching a live account, the same rule MT5 execution already had.
22 September 2026
- Risk Manager agent: watches the account, locks it, alerts by push, e-mail and SMS. It closes open positions if you asked it to.
- Market Research and Technical Analysis agents.
- MT5 multi-broker connection: search your server by name among 1,826 brokers, fix wrong credentials without recreating the connection.
- Supported brokers page.
- Account deletion was broken and deleted nothing. Fixed, and it now covers the trading cockpit, the copier, the agents and the notification subscriptions.
- Next.js upgraded to close two critical vulnerabilities. Rate limiting now counts per token and per IP.
Known limits
Master to follower replication works and goes through the risk engine. Links touching a live account are refused for the same reason as above.
They are on the list and depend on their APIs. Today you import their CSV export, which the journal reads with a dedicated profile.
Web push works out of the box. The e-mail and SMS channels are wired but wait on provider credentials, so they currently say so instead of pretending to send.
It stops a script hammering the API from one place. It is not a global quota shared across every serverless instance, and we have not needed one yet.
Supabase runs in ap-northeast-1, the web functions in hnd1, the background worker in Singapore. If you need EU-only hosting, BLX is not there today.
Found something else broken? hello@blx.ac. Bug reports from beta users jump the queue.