Overview

Security & encryption

How Rust Pulse stores your Rust+ pairing token, why it matters more than your Steam ID, and why this product is safer to use than self-hosted alternatives.

When someone asks "is Rust Pulse safe?", what they're really asking is "can someone act as me in-game?". Your Steam ID is not a secret — it's printed on every server roster and BattleMetrics page. The object that actually lets a client pretend to be you on your server's Rust+ socket is a different thing: the Rust+ pairing token. That's what this page is about.

Authentication happens on Steam's own page. Rust Pulse never sees your Steam password.
After Steam confirms, we receive a signed Steam ID and store only your Steam ID, display name, and avatar — all public information.
Sessions ride in encrypted, httpOnly, secure cookies. JavaScript on the page can't read them. Browser extensions can't read them.

Pairing token: AES-256-GCM at rest

When you pair a server with Rust+, a push notification arrives containing a long-lived player token — the secret that lets a client speak to your server's Rust+ socket as you.

In our database:

The pairing token and the full Firebase credential bundle are encrypted with AES-256-GCM before being written.
The encryption key is held in the server's runtime environment. The key is never in the database. A full database leak yields opaque ciphertext.
The token is decrypted in memory only when our backend needs to open a Rust+ connection on your behalf, then dropped from memory.

Upload guard

When the Credentials Helper uploads your pairing bundle, the backend decodes the payload, reads the Steam ID inside, and rejects the upload if it doesn't match the Steam ID on your session. An attacker who somehow took over your dashboard could not paste in someone else's pairing credentials and re-bind them to your account.

Short-lived connection tokens

The dashboard and overlay don't talk to the live data stream using your session cookie. They request a short-lived token, scoped to your account, that expires in minutes. The data stream accepts only those tokens — long-lived secrets never leave the backend.

Device pairing codes

When you activate the Credentials Helper or the overlay, you do it with a short code like RUST-7A3B.

Codes expire 10 minutes after they're issued.
Maximum 3 outstanding codes per account.
The 48-byte bearer token that the desktop app stores is returned exactly once on activation; if the app loses it, the old code is gone and you mint a new one.

Payments

Stripe handles every dollar that changes hands. We never see card numbers. Stripe signs every webhook it sends us; we verify the signature against the raw payload before doing anything with it, and we record every event ID so a replayed webhook is a no-op.

What this all means in one sentence

Rust Pulse uses Steam OpenID for login and AES-256-GCM with a server-side key for your Rust+ pairing token. Even a full database leak doesn't expose the thing an attacker actually wants — unlike self-hosted bots that keep that same token in a plaintext file on whoever's computer is running them.