如何在Github上检查python代码以确保它不会以某种方式导出您的登录凭据？

Question

I like to play around with trading bots on Github, and have for a few years now. I never really worried about someone hacking my accounts because I usually just did demo or very small like less than $500 accounts. I am now setting up a Robinhood bot on a very large account, and would like to use a Python API wrapper I found on Github. Is there a quick way to make sure it can't somehow export my login info, without going through all the source code? I'm sure it probably doesn't, but when working with an account this big it's not worth taking chances and security is VERY important.

I dabble in Python, but i'm not pro, so I don't even know all of the potential ways to export info. Even if I go through all the source code, I may miss something. So i'm wondering if maybe someone has a list of keywords to search the code for, or maybe I could just search for the variable name holding the password and check everywhere that it's being used or something? That's my best guess, as I would imagine for them to somehow export my password they would have to use the variable name storing the password...but regardless I would love to hear input on how others go about this. Thanks for your time!

Answer 1

检查是否有任何库调用回叫的最佳方法是在代理后面设置一个沙箱，并分析代理发出的所有传出呼叫。