ARC Raiders, Discord DMs, and the Hidden Cost of Game Integrations

The recent discovery that extraction shooter ARC Raiders was logging private Discord direct messages (DMs) in plain text to local files has ignited an intense discussion about privacy, security, and the risks hidden inside seemingly convenient game integrations. What began as a technical investigation by an engineer quickly turned into a wider debate about how much data games collect, how it is stored, and who might ultimately gain access to it.

This article breaks down what happened, why it matters even if no data left your machine, and how players and developers can better protect themselves when chat apps and games start talking to each other.

What Actually Happened in ARC Raiders

The incident centers on ARC Raiders’ use of Discord’s Social SDK. When players linked their Discord account to the game, the integration did more than just show rich presence or allow social features. A security researcher and engineer, Timothy D. Meadows, found that the integration was silently logging sensitive Discord data to local game log files.

Key findings from the investigation

According to Meadows’ technical writeup and subsequent news coverage, the ARC Raiders integration with Discord’s SDK was doing several problematic things:

• Private Discord DMs were logged in plain text to local game log files while the game was running.
• A full Discord bearer authentication token (essentially a long-lived login credential) was written to those same logs.
• Friends’ presence data and other Discord gateway data appeared in logs, including information about third-party users who never consented to interact with ARC Raiders at all.
• The SDK maintained a broad-scoped gateway connection, with access well beyond what was needed for basic in-game social features.

This behavior only affected players who specifically chose to link their Discord account with ARC Raiders, but the consequences extended to anyone they messaged while the game was open. That meant friends, co-workers, and other contacts could unknowingly have their side of the conversation mirrored into a game log they never agreed to create.

Where the data was stored

The logged content was not transmitted to Embark Studios’ servers according to the developer’s statement, but it was saved locally. The engineer and later articles point to a typical path like:

C:\Users<YourUser>\AppData\Local\PioneerGame\Saved\Logs

Within that folder, players could find log files containing snippets of private messages and the bearer token. While these files are not casually visible, any application or person with access to the machine could read them.

Why Local Logging Is Still a Serious Security Risk

Some players initially assumed the issue was minor because the data was stored only on their own device. In security terms, though, writing sensitive data to unencrypted logs is a major vulnerability, even if it never leaves the system by design.

Threats arising from local logs

Local log files are commonly accessed and shared during troubleshooting. That opens several realistic risk paths:

• Crash and bug report uploads: Many games encourage players to upload log files to report bugs. If these logs contain DMs and tokens, that data could reach developers, support staff, or third-party ticketing systems.
• Malware or local attackers: Any malware, untrusted program, or malicious user with access to your filesystem could scrape these logs and extract tokens or conversations.
• Shared or multi-user PCs: On shared gaming PCs, other users might be able to browse the game’s log folder and read sensitive content.

Security agencies and regulators consistently warn that local storage is not inherently safe. For example, the US Cybersecurity and Infrastructure Security Agency (CISA) stresses that any sensitive data stored locally should be carefully protected or avoided because it can be exfiltrated during broader compromises and incident response operations.¹

Why bearer tokens are especially sensitive

Discord’s bearer token is effectively a session credential. Anyone who obtains it may be able to:

• Access your messages, servers, and friends list.
• Change account settings or remain logged in until you change your password.
• Impersonate you, depending on how Discord detects and mitigates token theft.

Industry best practices, like those documented by the Internet Engineering Task Force (IETF) for OAuth 2.0, explicitly classify bearer tokens as highly sensitive secrets that must be protected like passwords and never written to logs.²

How Embark and Discord Responded

Once Meadows published his findings, coverage from tech and gaming outlets spread quickly. Embark Studios responded by issuing a hotfix and addressing players via community channels such as the official ARC Raiders Discord.

Embark’s immediate actions

Embark stated that:

• The issue was related to how the Discord SDK was logging data, not an intentional attempt to spy on players.
• No private data was sent off the local machine, and the studio did not review or store players’ private messages.
• A hotfix disabled the problematic logging behavior in the Discord SDK integration.
• The team launched a deeper audit of the game’s logging and data-handling to identify any other potential issues.

Players were also encouraged to contact support if they had concerns, and community moderators relayed that the hotfix was already live or imminent. The patch effectively stopped new DMs from being logged, though it could not retroactively erase logs created before the update.

Discord’s statement and SDK changes

Discord later confirmed that the incident related to debugging features intended for developers building Social SDK integrations. In a statement reported by gaming outlets, a Discord spokesperson said that some ARC Raiders players had Discord information stored locally due to those debugging features being active, and that:

• The affected data was stored only on players’ devices.
• Embark deployed a hotfix to stop the logging.
• Discord was updating its Social SDK with additional safeguards and offering guidance to developers to prevent similar issues.

Discord’s own developer documentation emphasizes that logging user content and tokens is not appropriate for production environments, and encourages developers to sanitize logs and only store minimally required data.³

Did ARC Raiders or Discord Actually Read Players’ DMs?

One of the most emotionally charged questions was whether Embark or Discord employees saw anyone’s private messages. Based on all public statements available, there is no evidence that either company systematically collected or reviewed players’ DM contents.

However, from a security and privacy perspective, the absence of evidence does not erase the underlying problem:

• The integration technically had the capability to access and log messages and tokens.
• Logs could have been shared through crash reports or troubleshooting, unintentionally exposing private data to staff.
• The mere fact that logs existed expanded the attack surface for any compromise of players’ devices.

This dual reality—no known misuse, but serious potential risk—is typical of many security incidents where vulnerabilities are discovered before large-scale exploitation.

Lessons for Players: How to Protect Yourself

Incidents like this are a reminder that convenience features can come with hidden costs. Players linking game accounts to chat apps should treat these connections as they would connecting to a bank or email provider: carefully and intentionally.

Practical steps you can take

• Review app authorizations: Regularly check connected apps in your Discord settings and revoke access you no longer use.
• Unlink if uncertain: If a game’s integration feels invasive or unnecessary, unlink it until you’re comfortable with its behavior.
• Search for sensitive logs: On Windows, look in game folders under AppData for Logs directories and delete old logs if they may contain private content.
• Enable multi-factor authentication (MFA): Discord offers MFA to make account takeover harder, even if a token or password is compromised.⁴
• Be cautious sharing logs: Before sending log files to support teams, skim them for sensitive data like tokens, chat snippets, or email addresses.

Signs a game integration may be overreaching

While most players are not security engineers, there are some red flags to watch for:

• The integration requests broad permissions that go beyond showing status or enabling game invites.
• You see chat content or friend data in in-game overlays that you didn’t expect.
• Documentation is vague about what data is collected or how long it is stored.

Lessons for Developers: Logging, SDKs, and Privacy by Design

For developers, the ARC Raiders incident is a textbook reminder that logging is a security-sensitive feature. Debug logs that are harmless in development can become liabilities in production.

Better logging practices

Security-sensitive development guidelines from organizations like OWASP stress a few core principles for secure logging:⁵

• Never log secrets: This includes passwords, bearer tokens, API keys, and private message contents.
• Use redaction and masking: If you must log something partially sensitive (like an email), redact key portions.
• Separate debug from production: Debugging flags that log extra data should be strictly disabled in release builds.
• Minimize scope: Only log what you truly need for diagnostics and performance monitoring.

Choosing and configuring third-party SDKs

Third-party SDKs are attractive shortcuts for features like voice, presence, or invitations, but they also come with their own configuration pitfalls.

To reduce risk, studios should:

• Audit SDK defaults: Some SDKs enable verbose or diagnostic logging by default; these should be turned off in shipped builds.
• Request minimal scopes: Only ask for the specific API permissions required for the feature set; avoid catch-all scopes.
• Monitor SDK release notes: Stay aware of security-related updates and best-practice guides from SDK providers.
• Include privacy in testing: QA and security reviews should specifically check what data is being logged and where.

Broader Implications for Online Gaming Privacy

The ARC Raiders case is just one example in a larger pattern: games are increasingly interconnected with chat apps, streaming services, and social networks. That interconnectedness creates rich social experiences—but it also multiplies the ways personal data can leak.

Growing regulatory and user expectations

Data protection regimes like the EU’s General Data Protection Regulation (GDPR) and similar laws worldwide expect companies to apply principles like data minimization and privacy by design to all user data, including logs.⁶ Even when data never leaves a user’s machine, regulators may scrutinize whether software could reasonably expose sensitive information through standard usage patterns like support interactions.

Players, too, are more aware and less forgiving. A single misconfigured integration can erode trust not only in the responsible game but in platforms like Discord that granted the permissions to begin with.

A wake-up call, not the end of integrations

None of this means players should abandon rich presence or cross-platform chat outright. Instead, it underscores a few cultural shifts that are likely to become normal:

• Studios will face more pressure to publish clear privacy and logging policies for integrations.
• Platforms like Discord will need to tighten SDK defaults and more strictly enforce how partners handle logged data.
• Players may grow more comfortable treating permissions prompts with the same seriousness they give browser or mobile app permissions.

FAQs: ARC Raiders, Discord DMs, and Your Data

Did ARC Raiders send my Discord DMs to Embark’s servers?

Based on Embark’s statements and current reporting, there is no indication that private messages were transmitted off your local machine. The issue was that they were logged in plain text to local files, which could be exposed through bug reports, malware, or other local access.

Am I affected if I never linked Discord to ARC Raiders?

No. The logging behavior specifically affected players who connected their Discord account to ARC Raiders through the Social SDK. If you never linked Discord, the game did not have access to your Discord messages.

Can people I messaged be impacted even if they never played ARC Raiders?

Yes, in the sense that their side of a private conversation may have been logged in your local files while the game was running. They did not consent to that logging, which is one reason this incident is viewed as a significant privacy issue.

Is the issue fixed now?

Embark has released a hotfix that disables the problematic logging behavior in ARC Raiders, and Discord has updated its guidance and SDK protections. However, any logs created before the patch will remain on your system until you delete them.

How do I remove any logged DMs from my PC?

On Windows, navigate to your user profile’s local app data folder, locate the ARC Raiders (often “PioneerGame”) logs directory, and delete older log files. Always close the game first, and avoid deleting other files if you are unsure what they do.