Self-hosting
Security
FLICKED is a hobby project you host yourself. This is what that honestly means, so you can decide what you are comfortable with.
Plain HTTP is for testing only#
The Windows guide uses http:// throughout, and that is not safe
for anything beyond a test among people you know. It is written that way deliberately: it gets a
setup working without a domain or certificates. It is not production ready.
With no TLS:
Session tokens in the clear
Anyone between a player and your VPS (the same café Wi-Fi, a compromised router, an ISP) can read a token and act as that player until it expires.
Admin cookies in the clear
Yours is an admin session. Whoever captures it can add, edit and remove servers.
RCON passwords over HTTP
They are encrypted once they reach the database, but the form carrying them is not protected in transit.
No proof of identity
Without a certificate, neither a launcher nor a browser can tell your API from something answering in its place.
What FLICKED does protect#
- Session tokens are stored hashed. The database holds a SHA-256 of a token, so a database dump does not hand over live sessions.
- RCON passwords are encrypted at rest, with the keys kept outside the database in
DataProtection:KeyPath. A stolen database alone does not yield them. - FLICKED never sees a Steam password. Sign-in is Steam's own OpenID flow, verified server to server.
- The launcher's webview never holds a token. Rust keeps it in the OS keychain and makes the authenticated calls itself.
- Admin actions are checked on the server against
FLICKED_ADMIN_STEAM_IDS, on every request. Hidden buttons are a courtesy, not a control. - Forwarded headers are trusted only from loopback, so nobody can claim their request arrived over HTTPS.
The full table of credentials, where each lives and how it is stored, is in Architecture.
What must never be committed#
.env is in .gitignore and belongs there. If one of these reaches a commit, treat it as
public from the moment it is pushed. Rewriting history does not recall clones, forks, or anyone who already
fetched.
| Leaked | What to do |
|---|---|
STEAM_API_KEY | Revoke and regenerate it at Steam |
| Database password | Change it in Postgres and in .env |
| RCON passwords | Change them on each CS2 server, then re-enter them in the dashboard |
DataProtection keys | Rotate the folder, then re-enter every RCON password |
A public repository also publishes things that are not secrets but do describe your setup: addresses,
open ports, which services run where. None of that is a credential, and a port scan finds most of it
anyway, which is why these docs use <vps-address> rather than a live host.
Your server address is not a secret#
It surprises people: a CS2 server's address is published to every player who connects, appears in their console, and is compiled into the launcher you hand out. It cannot be kept private while people play on it. What matters is that the credentials above stay out of the repository.
Reporting a vulnerability#
Do not open a public issue. Contact the maintainer privately and give them time to fix it first. If you think you have committed a credential yourself, say so immediately rather than quietly force-pushing: the fix is to rotate the credential, not to hide the commit.
Changes that make the secure path easier are very welcome. See Contributing.