-
Notifications
You must be signed in to change notification settings - Fork 0
Security
meetsu edited this page Mar 23, 2026
·
6 revisions
All accshift data is stored locally on your PC. Nothing is uploaded to any server.
| Data | Location |
|---|---|
| App config | %APPDATA%\com.accshift.desktop\state\ |
| Platform snapshots | %LOCALAPPDATA%\com.accshift.desktop\platforms\ |
| Roblox accounts | %LOCALAPPDATA%\com.accshift.desktop\platforms\roblox\accounts.json |
| Logs | %APPDATA%\com.accshift.desktop\logs\ |
| Settings & themes | %APPDATA%\com.accshift.desktop\user\ |
- Roblox cookies are encrypted with Windows DPAPI — only your Windows user account can decrypt them.
- Steam API keys are encrypted with the same mechanism.
- Riot and Ubisoft session files are stored as-is (not encrypted). They contain session tokens that are only valid on this machine.
accshift supports an optional PIN lock that blurs the window after inactivity. The PIN hash is stored locally. A short delay is added after failed attempts to prevent brute force.
- External navigation is blocked in production — the webview can only load accshift pages.
- Content Security Policy does not allow
unsafe-eval.
- Add-account setup sessions use random UUIDs.
- Pending setup flows expire automatically after a few minutes of inactivity.
- Steam, Riot, Battle.net, Epic, Ubisoft, and Roblox setup flows all have independent expiration timers.
When accshift updates its storage layout, it migrates data from the old location to the new one. Legacy files are backed up to %LOCALAPPDATA%\com.accshift.desktop\backups\pre-migration\ before being moved.
If auto-detection fails for any launcher, you can set the path manually in Settings. This is stored in the app config and does not modify any launcher files.