Sessions and sign-in
Accounts use server-side sessions. Sensitive flows require CSRF protection, while Google sign-in remains separate from your account password.
SECURITY
Protect your account and streaming secrets.
LiveArcadeHub uses authenticated sessions, CSRF protection, origin controls and revocable keys where those surfaces require them.
Revocation
Associated devices can be shown in Account, and revoking an active device is supported by the current backend.
The key is secret
A Browser Source URL may contain a revocable key. Do not publish it. If exposed, revoke it and generate a new one.
Never send
Passwords, session cookies, tokens, private keys, Browser Source keys, 2FA codes or environment files containing secrets.
Responsible reporting
If you find a security issue, do not publish it together with tokens or user data. Use Support and provide reproduction steps without secrets.