What YARK stores locally and how to handle secrets

Local by default

• Server profiles, settings, events, and backup metadata → local SQLite
• No YARK cloud account
• Backup ZIP contents live where you configure (often under the install folder)

“Local” does not mean every copy is secret from the same Windows user. The profile database stores admin and join passwords as ordinary columns. ASA still requires those values in GameUserSettings.ini, so a process or person who can read your install folder (or AppData) as your Windows user can recover them from INI, INI backup ZIPs, or the profile DB. YARK does not claim an extra encryption layer on top of that Windows-account boundary.

Network use

Destination	Purpose
Steam / SteamCMD	Dedicated server files
Wildcard public status CDN	Display-only official ARK version string
CurseForge metadata Worker	Names/summaries/links/screenshots for Project IDs; plain-text description on get-by-id inspect (self-hostable from the repo)
GitHub	Manual installer download, and in-app YARK updates check/download from Releases
Operator-chosen AdminListURL	RCON Admins Validate / Apply fetches your remote http(s) whitelist URL from the main process (desktop trust boundary; not a YARK cloud hop)

The desktop app does not embed a CurseForge API key. Lookups send Project IDs / search queries — not profiles, passwords, or install paths.

Secrets hygiene

Danger

Admin and RCON passwords live in ASA INI files and in YARK’s local profile database. INI backups can contain the same secrets. Treat install folders, backup ZIPs, screenshots, shared logs, exported configs, and GitHub issue attachments carefully. YARK omits password settings from diagnostic dumps; it does not encrypt the files the dedicated server must read.

• Prefer the site / Releases download buttons over random mirrors
• Compare the installer SHA-256 with the digest on the matching GitHub Release
• Strip passwords before posting logs or INI snippets
• Store backups only in locations trusted by the same Windows account boundary

Verify the installer

Get-FileHash ".\YARK-server-manager-Setup-VERSION.exe" -Algorithm SHA256

Compare the complete value with the digest GitHub shows for the matching asset under YARK Releases. A mismatch means the file must not be installed.

Current protection boundary

• Windows account and filesystem permissions are the primary at-rest boundary for INI files, install trees, and the local profile database.
• ASA requires credentials in its own configuration, so the dedicated server and YARK both store them as plaintext for this Windows user.
• Logs, crash excerpts, and operational-log exports omit GUS password settings rather than reprinting them.
• YARK should be locked or closed before letting an untrusted person use the same Windows session.
• The written threat model (SQLite vs INI vs diagnostics) lives in the repository: docs/credential-threat-model.md.

Process trust

YARK spawns ArkAscendedServer.exe from your install path. Keep installs on paths you control; do not point profiles at untrusted directories.

Recursive copy, backup packaging, restore, move, and ASA cache sync treat install trees as real folders and files only. Windows directory junctions and other links on a write path (including parent folders) fail closed before YARK creates or copies files; Robocopy uses /XJ so source junctions are not followed (#322).

Packaged Windows builds enable Electron fuses and ASAR integrity validation (see the versioning / packaging notes in the repository). Unpackaged npm run dev builds use Electron’s default fuse wire.

Report a vulnerability in YARK

If you believe you found a security bug in YARK itself (not ASA / SteamCMD):

• Prefer private vulnerability reporting when enabled, or follow SECURITY.md.
• Do not open a public GitHub issue with exploit details.

External browser opens

In-app links that open your OS browser (target=_blank, Open release notes under YARK updates, About community links) only proceed for allowlisted http(s) hosts (ARK wiki, CurseForge, GitHub, Discord invite discord.gg). Other hosts are refused.