On the flip side, developers who try to build hosted open-source alternatives hit two massive walls almost immediately:

1. IP Rate Limits: Public exchange APIs (like Binance or Yahoo Finance) ban central server IPs within hours when multiple users request market data through a shared backend.
2. Market Data Redistribution Licensing: Exchanges demand thousands of dollars per month the moment a central server redistributes market feeds to third-party users.

To solve both problems at the root, I built and open-sourced OrderCraft (v0.1.0, MIT License) — a high-performance, 100% local-first financial charting and technical analysis terminal built with Go, React 19, TypeScript, and Lightweight Charts (Apache-2.0).

🏗️ How It Works: The Single-Binary Local-First Architecture

Instead of running in the cloud, OrderCraft compiles into a single standalone ~14.8MB executable (CGO_ENABLED=0) that runs directly on your machine (127.0.0.1). Because your machine connects directly to public market data feeds or your own brokerage API keys, there is no middleman server, zero telemetry, and no exchange redistribution bottleneck.

1. Zero-Dependency //go:embed Packaging

The entire frontend (React 19, TypeScript, Vite) compiles down into static assets and is embedded directly into the Go binary using //go:embed:

• No Node.js, Python, or external database installation required for end-users.
• Cross-compiles cleanly to standalone binaries for Windows (amd64), macOS (arm64 / Apple Silicon & amd64), and Linux (amd64 / arm64).
• Running ./ordercraft --app-mode automatically detects Chromium, Brave, or Edge and launches the terminal inside a native, frameless desktop application window.

2. Concurrent Go WebSocket Fan-In / Fan-Out Coordinator

Financial charting requires sub-second tick updates across multiple symbols and timeframes simultaneously. In internal/server/hub.go and internal/datafeed/:

• The Go backend manages upstream WebSocket streams and REST polling across Binance, Yahoo Finance, OANDA v20, Alpaca, and TwelveData.
• Incoming ticks are normalized, aggregated into live OHLCV bars in memory, and fanned out over a local WebSocket hub to all subscribed chart panes in the browser.

3. Pure-Go SQLite Persistence (0600 Permissions)

All historical OHLCV candle caches, multi-pane workspace layouts, custom chart drawings, indicator templates, and BYOK (Bring Your Own Key) brokerage credentials are stored in a local SQLite database:

• Historical bars are cached locally so switching timeframes or scrolling back in history is instantaneous.
• API keys (OANDA, Alpaca, TwelveData) are stored strictly on your local disk with 0600 file permissions (0700 directory permissions) and are masked (AKIA••••••••1234) across all status endpoints so raw secrets are never exposed back to the browser.

4. Custom Canvas 2D Drawing Primitives (ISeriesPrimitive)

While lightweight-charts (Apache-2.0) provides fast HTML5 Canvas candlestick rendering, it does not ship with interactive drawing tools out of the box. We built a custom Canvas 2D drawing engine from scratch supporting:

• Trendlines, Rays & Extended Lines (with OHLC magnet snapping)
• Fibonacci Retracements with customizable levels
• Parallel Channels & Shaded Rectangles
• Long & Short Risk-Reward Position Calculators with interactive Entry, Take-Profit, and Stop-Loss drag handles
• Multi-Pane Synchronized Workspaces: Split your screen into 1x1, 2V, 2H, 3, or 4-pane grids with synchronized crosshairs, symbols, and timeframes.

5. Hardening a 127.0.0.1 Server Against Cross-Tab Browser Attacks

One overlooked attack surface in local-first web apps is Localhost CSRF & Cross-Site WebSocket Hijacking. If a local server sets Access-Control-Allow-Origin: * or skips WebSocket Origin checks, any malicious website open in another browser tab can query [http://127.0.0.1:3000/api/](http://127.0.0.1:3000/api/)* and read user data.

Before releasing v0.1.0, we hardened the Go HTTP/WebSocket server to enforce:

• Strict loopback Origin validation (localhost, 127.0.0.1, [::1]) on both REST preflight/mutation handlers and the WebSocket upgrader.
• Upstream URL path and query escaping (url.PathEscape / url.QueryEscape) across all provider adapters to prevent SSRF/path traversal.
• http.MaxBytesReader payload caps and Slowloris connection timeouts (ReadHeaderTimeout, ReadTimeout, WriteTimeout).

⚡ Try It Out in 10 Seconds

You can grab the prebuilt v0.1.0 binary for Windows, macOS, or Linux directly from our GitHub Releases page, or build from source:

git clone https://github.com/ordercraft-hq/terminal.git
cd terminal
# Run in native frameless desktop window mode:
./ordercraft --app-mode

Out of the box, it streams live crypto (BINANCE:BTCUSDT, ETHUSDT, etc.) and equity data (AAPL, NVDA, SPY) with zero configuration or API keys required.

I'd love for you to check out the repository, give it a ⭐ on GitHub if you find local-first tools useful, and let me know in the comments (or in GitHub Discussions) what indicators or market data providers (IBKR, Polygon, local CSV/Parquet backtest replay) you'd like to see in v0.2.0!

👉 GitHub Repository: https://github.com/ordercraft-hq/terminal