Provenance and Licensing

Provenance and Licensing

The checked-in license contains the MIT grant and a project-specific disclaimer. The bundled Barlow font files have their own OFL notice. Tools used at runtime have their own terms. Keep applicable notices when redistributing an artifact. Repository license · Barlow notice

Content boundaries

Use games and storage you are authorized to access. DeckStream manages a user-supplied library and can show Steam store metadata. The project excludes torrent and warez indexing, DRM circumvention, and proprietary console ROM runners from contribution scope. Game files are served from the configured storage. Contributor rules · Storage contract

Credentials and integrity

• The site uses a shared queue password. Storage credentials are separate and the app stores settings in browser local storage. The Deck stores storage settings in ~/.config/deckstream/storage.conf with mode 600. README security notes
• The installer checks shipped files against the manifest hashes. Those hashes detect byte changes relative to the manifest. Signed self-update uses separately configured trust. Use a deployment you control and keep its credentials private. Installer · Manifest tool
• File links are constrained to the configured storage host and explicitly allowed extra HTTPS hosts. Report suspected credential exposure privately where possible and omit secrets from public issues and reports. Host validation