Alive Desktop stores its configuration in config.json beside the executable when that directory is writable. The file contains the Alive global secret in plain text so the client can authenticate unattended reports.

• Never commit or publish config.json.
• Do not include logs or screenshots containing the secret in bug reports.
• Rotate the Alive secret immediately if it is exposed.
• The NetEase detector only reads local playback metadata. It does not read or transmit account cookies, login tokens, or passwords.

Report security issues privately to the repository owner rather than opening a public issue containing sensitive details.