An exchange API key with withdrawals disabled answers the smallest custody question. Here are the two it hides, and how to check any bot in five minutes.