About Proton Pulse

Steam sign-in, not OAuth

We use Steam OpenID 2.0. Steam sends back three pieces of profile data: your 64-bit Steam ID, public display name, and avatar URL. Nothing about your library, friends, purchases, or email.

Sign-in exists so reports can be tied to a real Steam account. That makes tier scores honest (no throwaway votes) and lets you edit or withdraw your own reports later.

Library and wishlist matching is a separate pull. It fires the first time you land on the profile page (library) or tap the "On wishlist" browse chip (wishlist), then only when you tap Refresh. Steam only returns anything when your Steam profile visibility is set to Public -- Friends only or Private returns nothing and nothing is cached. Details in the Steam Library wiki.

Delete anytime, reports go anonymous

Delete your account from the profile page at any time. It runs immediately, no email step. Everything that identifies you is removed: avatar, Steam ID, auth record, and saved system profiles. The compatibility reports you left behind are anonymized instead of destroyed, so tier scores stay accurate for everyone else. This is the GDPR right to erasure.

One caveat: a report's free-form notes are kept as part of that anonymized record, so do not put personal information in the notes field.

Read the code

Prefer to read the code? Here are the files:

• Sign-in flow: steam-callback edge function
• Erase flow: admin_erase_user migration
• Full policy: privacy.html

Automated scanning

Every push and pull request runs through CodeQL static analysis (XSS, injection, auth bypass), Semgrep with OWASP + TypeScript rulepacks (SAST coverage for the Deno edge functions), Syft-generated SBOMs scanned by Grype against NVD for supply-chain coverage, Dependabot for known dependency CVEs, and npm audit gating on high/critical vulnerabilities. Issue attachments are hash-checked against VirusTotal.

Security hardening

The site ships a Content Security Policy restricting script and connection sources. All edge functions enforce per-IP rate limiting. Database access uses Row-Level Security so users can only modify their own data. Internal auth tokens are derived via HMAC-SHA256.

Pen testing and standards

Manual security audits are conducted against OWASP Top 10 and CWE Top 25. Full findings, CWE references, and fix verification are documented on the Safety wiki. Report vulnerabilities via GitHub Security Advisories.

Vulnerability disclosure policy

The full disclosure policy lives in SECURITY.md. It covers scope, response SLA (acknowledge within 72 hours), and safe-harbor language for good-faith research. The same policy mirrors to the Decky plugin repo.

Backup restore drill

Backups are HMAC-signed and pushed to a private mirror on every schema change. Every 90 days a scheduled workflow files a drill issue against the runbook so the restore path is exercised against a scratch Supabase project. A backup that has never been restored is not a backup.