Security model

What this application does with your secrets, what it deliberately refuses to do, and — the part most pages like this leave out — what it cannot protect you against.

Where secrets live

Every account's shared secret, identity secret and revocation code is held in a single encrypted vault file on your machine. Nothing is stored anywhere else and nothing is transmitted to us; we operate no account system and no sync service.

Key derivation

scrypt, deliberately tuned to take a noticeable moment on ordinary hardware. That cost is the point: it is paid once when you unlock, and paid again by anyone trying to guess your passphrase, several billion times.

Encryption

AES-256-GCM. The authentication tag covers the vault's version, the key derivation parameters and the nonce as additional data, so a file cannot be altered — including downgrading it to weaker parameters — without the decryption failing outright rather than silently producing something wrong.

Writing

Every save is written to a temporary file, flushed to disk, and renamed over the target. A crash mid-write leaves either the old vault or the new one, never a half-written file. The previous version is kept as a backup.

Locking

The vault locks on idle and on demand, and the derived key is dropped from memory when it does. Unlocking requires the passphrase again — being logged in to the computer is not treated as being present at it.

How the application is put together

• Secrets never reach the interface. The window is a sandboxed renderer with no Node access and no direct filesystem access. It receives generated codes — which expire in thirty seconds and cannot be turned back into the secret that made them — and never the secrets themselves.
• A closed list of permitted messages. The interface can ask the privileged part of the application for a fixed set of named operations, each with a validated shape. There is no general-purpose bridge.
• No remote content. A strict content security policy with no remote origins, and navigation locked to the application's own files. There is nothing for an injected script to fetch and nowhere for it to send.
• Developer tools are disabled in release builds, together with the menu accelerator that opens them. "Open the console and paste this to fix your codes" is an attack that works on real people.
• Four runtime dependencies. Every package that ships is a package someone could compromise, so there are as close to none as the job allows.

Deliberate refusals

• No self-updating. The application checks whether a newer version exists and links to it. It never downloads or executes one.
• Automatic confirmation is allowlisted, not configurable. It can act on market listings and trades. Account recovery confirmations are held back and reported to you, and no setting exists to widen the list.
• Revealing a revocation code requires the passphrase again, even with the vault already unlocked.
• Removing an account requires an explicit acknowledgement, because forgetting an account locally does not remove the authenticator from Steam, and the two get confused with expensive results.

The honest caveat about automatic confirmation

Automatic confirmation can act on market listings. That is the same route a compromised account is emptied through — everything listed on the Community Market, the balance spent on the attacker's own listings — and it would be dishonest to describe the feature without saying so.

The distinction is where the listing comes from. This application only ever confirms what Steam is already asking about; it cannot raise a listing itself. But if something else with access to your account can raise one — a stolen session, a leaked Web API key, a trading bot you have authorised — then leaving automatic confirmation on for market listings means this application will approve it without showing you.

So: it is off unless you turn it on, it is set per account rather than globally, and it is worth turning on only for accounts where the convenience is worth that trade. If you are not listing in volume, leave it off and confirm by hand. The Activity screen records everything it did either way.

What this cannot protect you from

• A compromised computer. Malware running as you, while the vault is unlocked, can read what the application can read. Full-disk encryption and a machine you control matter more than anything in this application.
• A weak passphrase. scrypt raises the cost of guessing; it does not make a six-character passphrase safe.
• You approving a malicious trade. The application shows you what Steam said and does what you tell it. It cannot know that the person on the other end is not your friend.
• Phishing. No software prevents someone typing their passphrase into a convincing copy of it. Verifying what you run is the defence.

Reporting a vulnerability

Privately, please, rather than as a public issue. Two routes, both live: GitHub private vulnerability reporting, which is preferred, or [email protected]. What we commit to is written down: acknowledgement in 72 hours, an assessment in 7 days, a fix or a dated plan in 30 for a confirmed high or critical.