This repository automates Steam login/update flows. Treat all credentials as sensitive secrets.

1. Never commit config/.env with real usernames/passwords.
2. Use config/.env.example only as a template.
3. Do not hardcode credentials in any .bat script.
4. Keep Steam Guard enabled on all managed accounts.

# Good
ACCOUNT1_LOGIN=myusername
ACCOUNT1_PASSWORD=mypassword

REM Bad: never hardcode credentials in scripts
set LOGIN=myusername
set PASSWORD=mypassword

• Check git status before every commit.
• Review staged changes with git diff --cached.
• Ensure .gitignore still contains .env and *.env patterns.

If credentials were exposed:

1. Change all exposed Steam passwords immediately.
2. Rotate related credentials/tokens.
3. Review recent commits and repository access.
4. Re-clone into a clean workspace if needed.

git clone https://github.com/<owner>/esports-steam-tools.git
cd esports-steam-tools
SETUP.bat

Then edit config/.env locally with new credentials.

• No .env files are staged.
• No passwords appear in diff output.
• Only intended scripts/docs were changed.

• Steam Security FAQ
• Environment Variables Best Practices