Apple Steam is pre-release research software. Only the current main branch is actively supported.

Please use GitHub's private vulnerability reporting for this repository. Do not open a public issue for a vulnerability involving device pairing material, signing credentials, sandbox escape, arbitrary code execution, or user data.

Include the affected commit, iPadOS/macOS versions, reproduction steps and the smallest redacted diagnostic sample that demonstrates the issue. Never upload pairing records, provisioning profiles, private keys, Steam credentials, or guest disks.

This project does not offer a bug bounty and cannot promise a response time, but credible reports will be acknowledged and tracked through a coordinated fix when possible.

• Pairing and debugging: the embedded provider can hold device-specific pairing material and a retained debugger relationship. Pairing records stay in protected app data, must never enter source control, and should be removed by deleting the app and revoking the paired host when a device changes hands.
• VPN capability: the Packet Tunnel Provider exists to support the local JIT/debug transport. Treat its entitlement and process as privileged. The implementation must not expose a general network tunnel or accept remote control traffic.
• Guest boundary: QEMU, graphics translation, SPICE, filesystem images and imported guest software process untrusted data. Keep display/control sockets local to the app container and avoid exposing host files directly to guests.
• Accounts and disks: Steam credentials, cookies, saves and game content can persist in guest disks. Disks and authenticated screenshots are user data; do not attach them to issues or release artifacts.
• Diagnostics: serial, QMP, crash and build logs may reveal usernames, container paths, device identifiers and account state. Redact them before sharing and prefer the smallest excerpt that reproduces a defect.