Security boundaries you can inspect

Credentials and keys

Platform API keys are accepted through the X-API-Key header. API keys, viewer tickets, Steam cookies, refresh tokens, and authenticator secrets are not accepted in viewer URLs.

Steam passwords and one-time Guard codes are held for the bounded command attempt and destroyed after the attempt. OpenSkin does not provide an endpoint that exports an imported authenticator or recovery code.

Encryption and worker access

Stored Steam secret material uses a dedicated encrypted-envelope contract. Each secret receives its own data-encryption key, and decrypt access is restricted to the exact isolated automation worker performing the operation. Plaintext is kept in memory only for the shortest necessary time.

The public API, delivery worker, and Steam automation worker have separate responsibilities, with secret access limited to the component performing the requested operation.

Audit and deletion boundaries

Secret access, account mutations, and trade operations produce audit metadata without recording the secret itself. Disconnecting a Steam account revokes and destroys its active stored secret material under the documented custody contract.

Webhook signing secrets are returned once and are not returned again by an idempotent retry. Customers should keep their own receiver and API-key access under review.

Responsible disclosure

Please report a suspected security issue to [email protected]. Do not include passwords, API keys, Steam cookies, authenticator secrets, or recovery codes in a report.