Security

Security

Steam credentials grant access to API data and, for publisher or game-server keys, potentially privileged operations. Treat every credential as a secret.

Never expose

• normal Steam Web API keys;
• Steamworks publisher keys;
• game-server login tokens;
• URLs containing a key query parameter;
• .env files or CI secret values.

Do not place credentials in browser JavaScript, mobile apps, desktop apps, game clients, screenshots, issue reports or committed files.

Server-side configuration

STEAM_API_KEY=your-key-here

Use environment variables or a managed secret store in production. Restrict secret access to the application components that perform Steam requests.

Separate privileged clients

$steam = new Client(apiKey: $normalKey);
$publisher = (new Client(apiKey: $publisherKey))->publisher();

Do not reuse a publisher key for ordinary public-profile requests.

Logging

Log endpoint names, status codes and non-sensitive resource identifiers. Redact query strings and authorization data. Be careful with exception messages from HTTP clients because they may include request URLs.

Rotation

Rotate a key immediately when it appears in:

• Git history;
• CI output;
• an issue or pull request;
• screenshots or chat messages;
• public application bundles.

Removing a key from the latest commit is not enough after publication; consider it compromised.

Dependency checks

composer audit --locked

Keep PHP, Laravel, Guzzle and development tooling within supported security release lines.

Reporting a vulnerability

Do not publish secrets or exploitable details in a public issue. Contact the maintainer privately through the repository owner's available contact channel before public disclosure.