@koyu not sure how much leaking a steam token on that side matters though. valve does everything through oauth/openid tokens so they're pretty well atomized as to exactly which publisher is doing shit they shouldn't and its trivially revokable on valve's side.