Document the environment variables the app reads
TCNO_ALLOW_STEAMGUARD_CAPTURE and TCNO_STEAMGUARD_CONFIRMATION_DUMP had
no home in the wiki - the capture flag was mentioned under Steam Guard,
its variable was not, and the confirmation dump has no flag at all, so
the only way to find it was to read the source.
Both are read once at startup and neither is a setting, which is the
part worth stating: nothing in the app turns them on or off later, and
they take any value that is not empty, 0 or false.
The dump writes live trade payloads to disk, so its entry says what
lands in the file and that it is worth reading before attaching one to
a report.
The development half - the opt-in live probes, their vault password and
the dumped-page fixtures - sits in Building from source instead, next to
the note that an ordinary test run touches neither the network nor a
vault. It also records why these are variables and not flags: task dev
cannot forward arguments to the app.
Document the Steam Guard vault and where game statistics come from
The wiki told users the app does not collect passwords. That stopped
being true when Steam Guard arrived, and a wrong security claim is worse
than none. Home, the FAQ and the Steam page now separate the two cases:
account switching still involves no password, while Steam Guard takes
one because Steam sign-in requires it, encrypts it under a key fetched
from Steam, and keeps the session token rather than the password.
The password paragraph is deliberately not the flattering version. The
working copy the app makes is zeroed, but the string handed over by the
window cannot be, and the page says so - claiming full erasure would be
a promise the runtime does not keep.
A new Steam Guard page covers the vault layout, the KDF and lease
settings, what stays readable in plaintext while the vault is locked and
why, login-only against full authenticator records, and what is
genuinely unrecoverable if the vault password is lost.
A new statistics page covers the provider chain per game, which figures
come from Steam's own authenticated page and therefore need the vault
unlocked, how long each answer is cached, and what leaves the machine
for whom.
Two settings are documented by what they do rather than by their names.
CS2 Rank off takes Steam out of the chain entirely, so configured rows
fall through to Leetify and CSRep and start sending a SteamID64 to third
parties. CS2 Cooldown gates only the display: the sweep still reads and
still writes CS2Cooldowns.json while either of the other two is on, and
re-applies a tag that turning the setting off had cleared.