How Rust Pulse compares to rustplusplus
Why Rust Pulse is safer to use than the popular self-hosted rustplusplus Discord bot, despite doing many of the same things.
rustplusplus is the popular open-source self-hosted Rust+ Discord bot. It does many of the same things Rust Pulse does — team-chat commands, alarm alerts, event tracking, custom switches. So a fair question is: if both exist, why pay for Rust Pulse?
This page answers that, focused on the part most people actually care about: security of your Rust+ pairing token.
The thing that actually matters
To talk to your server's Rust+ socket as you, a client needs your player token — a long-lived secret delivered to your Rust+ companion app when you pair a server. Anyone who holds that token can sign in as you to that socket: read team chat, toggle switches, drain Storage Monitors, fake messages from you.
Your Steam ID is not that secret — it's printed on every server roster and BattleMetrics page. The player token is.
How rustplusplus stores it
rustplusplus is a Node.js Discord bot you run on a machine you control (your laptop, a VPS, a Raspberry Pi). To work, it needs the player token, and it stores it like this:
- Plaintext JSON files on disk, typically at
credentials/<steamId>.json. - No encryption.
- No key separation.
- No "decrypt at use" pattern.
That means:
- The owner of the machine running the bot can read it.
- Your VPS provider can read it.
- Anyone who's ever SSH'd into the box can read it.
- Anyone with a backup tarball, a stolen drive, or filesystem access can read it.
Public / shared rustplusplus instances are worse: whoever operates that instance literally holds the player tokens of every user who joined. They could sign in as any of them at any time.
How Rust Pulse stores it
- Encrypted with AES-256-GCM before being written to our database.
- The encryption key lives only in the server runtime environment. The key is never in the database. A full DB leak yields opaque ciphertext.
- Decrypted in memory only when our backend opens a Rust+ connection on your behalf, then dropped.
Plus a series of guards:
- Upload guard. When the Credentials Helper uploads credentials, the backend reads the Steam ID inside and rejects the upload if it doesn't match your session's Steam ID. An attacker hijacking your dashboard can't re-bind someone else's credentials to your account.
- Short-lived connection tokens. The dashboard and overlay never get a long-lived secret — they request short-lived scoped tokens that expire in minutes.
- Signed payment webhooks so a replayed Stripe webhook is a no-op.
- Steam OpenID for login — Rust Pulse never sees your Steam password.
Other differences
| rustplusplus | Rust Pulse | |
|---|---|---|
| Pairing token storage | Plaintext on disk | AES-256-GCM at rest, key off-database |
| Setup effort | Run Node.js, manage your own host | Sign in with Steam, click Activate |
| Web dashboard | None (Discord-only) | Full dashboard at rustpulse.app |
| In-game minimap overlay | None | Yes (premium) |
| Player intel / tracking | None | Yes (premium) |
| Phone push | None | Yes |
| Updates | You upgrade yourself | We deploy continuously |
| Server-wide outages | Your host's problem | Our problem |
| Cost | Free (you pay your own host) | Subscription |
One-sentence summary
rustplusplus stores the token an attacker actually wants in a plaintext file on whoever's computer is running the bot. Rust Pulse encrypts it with AES-256-GCM and keeps the key out of the database. A full database leak doesn't help an attacker; a single SSH session into a rustplusplus host does.
Credit where it's due
rustplusplus is a great project and a lot of the team-chat commands you see in Rust Pulse are inspired by it (we even ported the Oil Rig Chinook detection algorithm directly, with credit). The security gap isn't about quality — it's about what a self-hosted bot can structurally achieve versus a managed service with key separation.