RUST PULSEWiki
Credentials Helper

Helper security model

What the desktop helper actually has access to, what's encrypted, what gets uploaded to Rust Pulse.

The helper is a small desktop app — and like every desktop app it has some access to your computer. Here's exactly what.

What it can see on your computer

  • Your Steam login cookie for Facepunch's site, stored in its own isolated browser profile (not your real Chrome / Edge / Firefox profile). Clear it from Settings → Sign out of Steam.
  • Its own activation token, stored in your OS keychain (macOS Keychain / Windows DPAPI / libsecret on Linux). On Linux without a keyring it falls back to plaintext on disk and the UI shows a warning.

What it does not see

  • Your Steam password. Steam authenticates you on Steam's own page. The helper just renders the page.
  • Any file outside its app data directory. It's sandboxed — nodeIntegration: false, contextIsolation: true, sandbox: true. It can't read your documents, your other browsers, your Steam install, anything.
  • Your team chat or your Rust game state directly. Those live in the live data stream from the Rust Pulse backend, not on your computer.

What gets uploaded to Rust Pulse

  • The push credential bundle Facepunch produced for your Steam account.

That's it. The bundle is uploaded over HTTPS, then encrypted with AES-256-GCM at rest on the Rust Pulse backend. The encryption key never lives in the database. See Security & encryption for the backend side.

Upload guard

When you upload the bundle, the backend reads the Steam ID inside and rejects the upload if it doesn't match the Steam ID on your dashboard session. An attacker who somehow took over your dashboard session cannot swap in someone else's credentials and re-bind them to your account.

Why this is better than rustplusplus and similar bots

Self-hosted bots like rustplusplus store the exact same credential bundle as a plaintext JSON file on disk — meaning the host machine's owner, the VPS provider, anyone who's ever SSH'd in, and anyone with a backup tarball can read it and act as you on your server's Rust+ socket.

Rust Pulse uses AES-256-GCM with a server-side key. A full database leak yields opaque ciphertext. See the full comparison.

Removing the helper

Uninstalling the app removes its local files. To also revoke the uploaded credentials on the Rust Pulse backend, open the dashboard → Setup → Revoke credentials. That deletes the encrypted bundle and disconnects every server paired through it.