chore(No Story): Describe the security issue in the PR

[litao0515]

What security problem did you see? (1-2 bullet points)

1. All permission check should be moved to server side, along with any authentication
2. Sensitive data such as API key and password and financial data should never be logged, printed or directly handled in application code
3. Use atomic operation for financial data operation, such as db locks
4. Alway valid any user input
5. config should not have plain text secret
6. printing stacktrace is dangerous

What solution does your PR suggest? (1-2 bullet points)

See comment

How can we verify this solution? (1-2 bullet points)