Security & privacy

Local by default

• Server profiles, settings, events, and backup metadata → local SQLite
• No YARK cloud account
• Backup ZIP contents live where you configure (often under the install folder)

“Local” does not mean encrypted. In the current prerelease, server/admin credentials are stored in the local profile database and in the ASA INI files that require them. YARK does not currently apply Windows DPAPI protection to the database copy. A process or person able to read files as your Windows user may be able to recover those credentials.

Network use

Destination	Purpose
Steam / SteamCMD	Dedicated server files
Wildcard public status CDN	Display-only official ARK version string
CurseForge metadata Worker	Names/summaries/links for Project IDs; plain-text description only for Maps-category mods (map-token hints; self-hostable from the repo)
GitHub	Manual installer download, and in-app YARK updates check/download from Releases

The desktop app does not embed a CurseForge API key. Lookups send Project IDs / search queries — not profiles, passwords, or install paths.

Secrets hygiene

Danger

Admin and RCON passwords live in local profiles and ASA INI files. INI backups can contain the same secrets. Treat app-data copies, backup ZIPs, screenshots, shared logs, exported configs, and GitHub issue attachments carefully.

• Prefer the site / Releases download buttons over random mirrors
• Builds are unsigned today — SmartScreen warnings are expected
• Compare the installer SHA-256 with the digest on the matching GitHub Release
• Strip passwords before posting logs or INI snippets
• Store backups only in locations trusted by the same Windows account boundary

Verify the installer

Get-FileHash ".\YARK-server-manager-Setup-VERSION.exe" -Algorithm SHA256

Compare the complete value with the digest GitHub shows for the matching asset under YARK Releases. A mismatch means the file must not be installed. SHA-256 verifies the bytes against the official asset; it does not identify a publisher. Signed releases will add Authenticode publisher and timestamp verification when that release control is implemented.

Current protection boundary

• Windows account and filesystem permissions are the primary at-rest boundary today.
• The local SQLite copy of server credentials is not yet encrypted by YARK.
• ASA requires credentials in its own configuration, so protecting the database copy cannot remove every plaintext occurrence.
• YARK should be locked or closed before letting an untrusted person use the same Windows session.
• Credential-storage hardening is tracked publicly in #144.

Process trust

YARK spawns ArkAscendedServer.exe from your install path. Keep installs on paths you control; do not point profiles at untrusted directories.

External browser opens

In-app links that open your OS browser (target=_blank, Open release notes under YARK updates) only proceed for allowlisted http(s) hosts (ARK wiki, CurseForge, GitHub). Other hosts are refused.