Refuse tests that require you to run code locally.

I smell something different, like a bad guy broke his own bank

just bad security arch, should be like Coinbase MPC, exclude single point with whole private key

Oh yes, this does not release them from responsibility over security practices