Safety
What the stub does, what it never does, and where every file goes
The stub is a small C# process with no game code, no network code and no access to Discord. This page is the full boundary, written so you can check it against the source.
What the stub does
Everything the session process is responsible for.
Holds its name
It runs under the executable filename Discord watches for the chosen game, inside a per-game folder under your local app data.
A timer and an end button
Unless you disable it, it shows a small window with the game name, elapsed time and an End session button.
Follows the launcher
It receives the launcher's process id and exits when that process exits, so a crash cannot leave it running.
Parsed explicitly
--title, --app-id, --parent and --hidden are matched as whole arguments. Nothing is matched as a substring of the command line.
None
The stub creates no files, reads no files and writes no files. It only holds its process open.
None
It opens no socket and makes no request. It has no code to contact Discord.
What it never does
The deliberate omissions, which are as much a part of the design as the features.
No patch or injection
Discord's installation, memory and files are not touched. Zycord does not read the client at all.
No token, no account
There is no sign-in, no token capture and no stored credential of any kind.
No spoofing of Discord
The launcher does not talk to Discord or pretend to be it. It creates a local process and lets Discord's own client detect it.
No collection
No analytics, no crash reporting, no update check and no phone home. Nothing is measured.
No admin rights
The launcher runs as your user and never asks to elevate. It installs no service and schedules no task.
No autostart
Nothing is added to startup. Zycord runs only when you start it.
Every path it writes
All of it sits under one folder you can delete.
| Root | %LOCALAPPDATA%\Zycord\ |
|---|---|
| Settings | settings.json holds preferences, library, favourites, recents, history and window bounds. |
| Prepared games | games\<app_id>\ holds one renamed copy of the stub per game started. |
| Logs | logs\zycord-YYYYMMDD.log holds the day's plain text log. |
| WebView2 | webview\ is the profile folder the interface renders in. |
Path rules
Enforced before any file is written.
- The application id must be one to 25 digits.
- The executable entry must be relative, with no drive letter and no parent segment.
- Invalid filename characters are refused, and the extension must be one of the eight the validator accepts: .exe, .bin, .dat, .dll, .des, .jbg, .game or .pae.
- The entry is limited to eight path segments.
- After the path is built, it is resolved again and must still sit inside the games folder.
- A catalog entry cannot cause a file to be written outside that folder.
Process rules
A session is stopped only after the launcher confirms that the process with the recorded id still points at the exact file Zycord created for it. If the id has been reused by another program, or the file has moved, nothing is terminated. This is why Zycord never stops a process by image name.
Prepared files are removed only when no session is running. At startup, folders left behind by a previous run are swept before any session exists, so the sweep can never touch a file in use.
Network rules
The launcher does not contact Discord's API or gateway. The catalog is stored with the application rather than downloaded. The only remote resource is the game icon image, which the interface loads from Discord's icon CDN when the Games grid is shown. The interface's content security policy allows images from that host and nothing else, and blocks all other connections.
If you would rather not load icons at all, the interface falls back to a lettered tile when an image fails, so the grid still works.
Check it yourself
The stub source, the launcher source and the build script are in the
repository. The stub is a single C# file; the launcher is a small set of files
in the same repository. Build it with python build.py
and compare the result, or read the source before you run anything.