Warchive Security Review
Warchive runs in your game and, if you want the program, on your PC. So here's exactly what each part can touch, what it sends, who gets to see it, and how I checked it. Warchive is a fan project, not made by or tied to Blizzard.
The parts
| Addon | Runs in WoW and keeps your journal. |
|---|---|
| Program | Optional Windows tray app. Uploads the addon's saved file, reads the combat log to confirm kills, and brings your numbers and a backup of your journal back. |
| warchive.dev | The website. |
| Server | Checks uploads and stores them. It's the only thing that can change the database. |
The addon
WoW keeps addons in a box. The addon can't reach the internet or your files, and on WoW Forever it can't read the combat log either. The only thing that leaves the game is its saved file, which WoW writes when you log out or /reload.
Bounties, ratings and planned adventures go to other Warchive users in your party, raid or guild over WoW's hidden addon channel. New bounties and ratings also go out on WarchiveNet, a hidden channel for Warchive users on your ruleset. Each of these can be turned off in Settings > Sharing. Planned adventures never leave your party or guild. Ratings are anonymous: they carry a random rater ID instead of your name, in game and on the website. Everything else stays in your journal.
Anything that comes from another player gets treated like it could be fake:
- Text gets stripped of game formatting, pictures and links before it's saved or shown. Real item links stay.
- Only whoever wrote a rating, posted a bounty or planned an adventure can change it or take it back. Nobody can post as you.
- Numbers have to make sense, and each player can only send so much.
The program
| Reads | The addon's saved file and WoW's Logs folder. |
|---|---|
| Writes | Warchive_Inbox.lua, Warchive_Mail1.lua and Warchive_Mail2.lua next to the addon's saved file. The addon itself in Interface\AddOns when you click install or update (the last 3 versions stay in Interface\Warchive-backup in case you want one back). Its own settings and log in %APPDATA%\Warchive. Two entries in your user registry: start with Windows, and the name on its notifications. |
| Deletes | Combat logs it's done reading, once they're 2 days old. |
| Never | Touches the game or its memory, sees your Battle.net login, plays for you, or reads anything else on your PC. |
It runs as you, a normal user. No admin rights, no service, no driver.
The combat log has where players were standing when they hit or got hit. The program only uses that to put the dot on the website map, after the fact. It never sends anyone's position back into the game.
Nothing updates on its own, you pick when. Every release is signed with a key that stays offline on my PC (not on the website, the server or GitHub), and the program won't touch anything that doesn't match it. So even if someone broke into the website, they couldn't hand you a fake update. If a new version won't start, the program puts the old one back.
The program isn't signed with a Windows certificate yet, so Windows will probably warn you the first time you run it.
Your data
Warchive only sends game stuff. Nothing personal and nothing about your PC.
What goes to warchive.dev
Your character names, server and region. Kills, deaths and run-ins with other players from the addon and the combat log (names, class, zone, time, and where a kill happened). Your bounties, ratings and notes. Dungeon and raid runs. The program's version and its sync key.
What never does
Your Battle.net account, real name, email, password or payment info. Anything about your computer: its name, hardware or files outside WoW. The site has no accounts, ads, tracking or cookies. The server doesn't keep your IP address. Where it has to limit sign ups, it keeps a one-way hash of it instead.
What anyone can see
The kill feed, leaderboard, bounties, ratings, notes and runs on the website.
Sync keys
There's no shared password in the download. Every install gets its own key the first time it runs. A character belongs to the first install that syncs it. After that the server only takes that character's data from that install, and only that install can download its journal backup. I can shut off any one key without touching the rest. New PC? I can move your characters over, or they move on their own once the old install hasn't been used for 60 days.
The website and server
- Everything goes over HTTPS.
- The website only reads. Its database key can only read the public tables and can't see the server's own tables at all. Every change goes through the server, which checks the sync key, that the characters belong to that install, and the data itself.
- Anything a player wrote is escaped before it's shown, so it can't run as code.
- Who's behind a rater ID isn't in the public database.
- The site can't be framed by other sites, only runs its own scripts, and only talks to its own server and database.
- The keys that can change the database only live in the server's protected settings, never in the website or the code.
What it can't promise
- The addon alone can't prove who landed the killing blow. Kills and bounty claims only get marked confirmed after the program reads the combat log.
- Ratings and notes are what players think. Warchive makes sure of who wrote them, not that they're fair.
How I checked
I went through every part looking for what a stranger, another player or a tampered update could do with it, and fixed what turned up. One small addon fix comes with the next update: it held on to half-sent messages from other players until you logged out. The addon on October 19 (0.7.25) and again on October 26 (1.0.0). The program, website, server and database on October 26, before launch on November 4. I do it again before every big release and any time the way data moves between the parts changes, and this page gets a new date when I do.
Found something?
Message me on Discord, nextheoverlord, before telling anyone else. Send enough that I can make it happen myself, and please don't test on other players' characters or data.
Nex