pipcord may only use documented Discord local IPC/RPC with credentials belonging to this application.

• Operator-owned Discord Developer Application
• Operator listed under App Testers
• Client secret on the local machine (.env), never in git or logs
• OAuth scopes requested: identify, rpc, rpc.voice.read, rpc.voice.write
• Access/refresh tokens stored locally, not printed

If a feature cannot be done with the above, stop and document the limitation. Do not add:

• Discord user-token extraction
• Reading browser or Discord Local Storage / LevelDB for secrets
• Self-bot / user-gateway APIs
• JavaScript injection into Discord
• Modifying Discord installation files
• BetterDiscord / Vencord / Shelter as a required dependency
• DLL injection or process-memory scraping
• Spoofing another application’s client ID (including StreamKit 207646673902501888)
• UI Automation or screenshot scraping of the Discord window as the voice source of truth
• Shipping one shared client secret inside a public binary for other people

Several open-source voice widgets impersonate StreamKit or scrape the Discord UI so they work for everyone without partner RPC. That is a Developer Policy / ToS violation (impersonating another application) and is explicitly out of this project.

Log connection state, command names, and errors. Never log client secrets, authorization codes, or access tokens.