What the client does, and what it never does.

What it is

The client is built with Electron - the same framework behind Discord, Slack, Visual Studio Code, and many other everyday desktop apps. That is why the installer is around 100 MB: most of that weight is the standard Chromium and Node runtime that Electron ships. Our own application code is a small fraction of it and is ordinary, readable JavaScript - it is not obfuscated or packed.

It is a first-party app for one community: it shows your Rust stats and leaderboards, an in-game overlay, companion tools (map, calculators, Rust+ pairing), and it keeps itself up to date. That is the whole job.

What it never does

• No access to your browser, Discord, Steam, or Epic data. It does not read, copy, or touch cookies, saved logins, or session files from any other program. The only cookies it uses are its own sign-in cookies for braaimaster.co.
• No keylogging. It does not record your keystrokes. The only key handling is the overlay hotkeys you assign yourself, which just toggle the overlay locally.
• No file scanning or encryption. It does not crawl or encrypt your files. It writes only inside its own app folders.
• No third-party tracking or telemetry. It does not send analytics to any outside service. It talks only to the servers listed below.
• No hidden or remote code. It does not download and run scripts from anywhere, and it does not spawn hidden shells or scripting hosts to do its work.

Exactly where it connects

When the client is running, its network traffic goes to just these places, all over encrypted HTTPS:

• braaimaster.co - for your stats, leaderboards, social features, sign-in, and update checks. (This site is served through Cloudflare, so the address may resolve to a Cloudflare IP.)
• Your own Rust server - only if you choose to pair Rust+. That connection uses Facepunch's official Rust+ companion protocol and goes to the game server you are playing on, not to us.

That is the complete list. If you capture the client's traffic you should see only braaimaster.co (and your paired game server). There is no separate "beacon" host.

How signing in works

When you sign in "with your browser," the client opens your normal web browser to braaimaster.co and you log in there. Your password and any Discord or Steam login happen on the website in your own browser - the app itself never sees your password. The website then hands a short-lived, single-use code back to the app, which the app trades for its own session. You can also protect your account with two-factor authentication.

About signing and antivirus warnings

The installer is not yet code-signed with a paid certificate, so Windows SmartScreen may show an "unknown publisher" warning, and some heuristic antivirus tools may flag any unsigned Electron installer out of caution. A signing certificate is on our roadmap; until then, the best way to be sure your file is genuine is to check its hash below. A clean automated scan on a service like VirusTotal is another good signal.

If your antivirus flags it

Because the app is new and not yet code-signed, some antivirus tools flag it on reputation or behaviour alone - not because they found anything harmful. This is common for unsigned game overlays (Discord, OBS and others hit the same warnings when they are new). Here is what you might see and what to do:

• Windows SmartScreen ("unknown publisher"). Click More info, then Run anyway. This is the expected prompt for an unsigned installer.
• Norton blocks the overlay ("IDP.Generic"). Norton's behaviour engine can quarantine the in-game overlay, because a transparent window drawn over a game looks - to a heuristic - like any game overlay. The main client is usually allowed; only the overlay is affected. Open Norton's Security History (or the Quarantine view), find "Braai Master Rust Overlay", and choose Restore, then Allow / Exclude it. You can also use Check for New Rating.
• Another antivirus quarantines it. Add an exclusion for the Braai Master install folder, or restore the file from quarantine.

Before you allow any file, confirm it is the genuine one by checking its SHA-256 against the table below. We also submit each build to the antivirus vendors, so these warnings clear over time. If anything looks off, ask us on the Support page or in Discord first.

Verify your download

Before installing, confirm the file you downloaded matches the official hash. In Windows PowerShell, run:

Get-FileHash -Algorithm SHA256 "C:\path\to\the-installer.exe"

Compare the result (case-insensitive) to the matching row below. If it does not match exactly, do not run the file.

Hashes are updated here each time a new build is published. The version you install should always match a row on this page.

Questions or concerns?

If something about the client looks wrong to you, please tell us - we would rather explain it than have anyone guess. Open a ticket on the Support page or ask in Discord and staff will walk through it with you.