Safety and privacy

Why Windows or an antivirus tool may warn about the editor, how to check that your download is the real one, and what the editor does and doesn't send anywhere.

"Windows protected your PC"

Windows may say this the first time you open the .exe, because the .exe isn't code-signed. Click More info → Run anyway.

Antivirus warnings

The editor is a Python program, packaged for Windows with PyInstaller. Scanners that judge a file by its shape flag many PyInstaller programs, because malware gets packaged the same way: the 1.4.0 .exe was flagged by 6 of 71 engines on VirusTotal, all of them generic or machine-learning verdicts.

To give them less to trip over, the download is now a plain folder (the .exe no longer unpacks itself every time it starts), its launcher is compiled during the build (not PyInstaller's ready-made one, which malware also carries), and the .exe says what it is and which version. The 1.8.1 download was flagged by none of 66 engines (its VirusTotal page).

A scanner can still get a later version wrong, so the checks below stay worth knowing.

Checking your download

You don't have to take anyone's word for what's in the download:

• Nobody builds it by hand. GitHub Actions builds every release from the repository's source and attaches it (the workflow).

• You can check that. With the GitHub CLI, this confirms the zip you downloaded is the one that workflow built, and from which commit. It works on the MCD2SaveEditor.exe inside as well.

  gh attestation verify MCD2SaveEditor.zip --repo IshiakiZ/mcd2-save-editor
  

• The source is all there. Everything the editor does is in the repository.

• You can skip the .exe and run it from source. See Running from source.

Code signing

Releases are not code-signed, which is why Windows may warn the first time you open the .exe. Free signing for open-source projects (the SignPath Foundation's programme) is for projects that are already widely known, and this one isn't there yet. Until it is, the build attestation above is the way to check that a download is the one built from this source.

Privacy

The editor never sends your saves, your hero's data or anything about you anywhere. It contacts other computers in these cases only:

1. When its window opens, it asks GitHub (api.github.com) which version is the latest. That request carries only what any web request does: your IP address, and the editor's name and version.
2. When its window opens, it also asks batch-ly.com, the developer's own site, for the list of the editor's item pictures, and downloads the ones this PC hasn't got: all of them the first time, then only new ones. Those requests carry the same and no more. Menu → Pictures → Don't get item pictures automatically turns this off.
3. When you press Update, it downloads that version from GitHub.
4. When you ask for item pictures (Menu → Pictures → Get item pictures…), it gets them from batch-ly.com, or from minecraft.wiki if they aren't there. The Minecraft Wiki is never asked unless you ask.

The edition for Nexus Mods does none of this: it never goes online.

Links open in your own browser.

Share item IDs… sends nothing by itself: it makes a list for you to read, and opens a GitHub issue in your browser for you to send or not. Share this recording…, in the play recorder, works the same way. See Teach the editor.

The edition built for Nexus Mods, which doesn't host programs that go online, does none of the three: everything that would open a connection is switched off when it's built (dungeons2_editor/edition.py), and the build checks that it refuses.

Where the editor keeps its files

The .exe keeps backups, pictures and settings in %LOCALAPPDATA%\MCD2 Save Editor, not in its own folder, so a newer version can simply replace the folder. Run from source, they stay in the unzipped folder.

Backups contain your sign-in token, so don't share them. A backup is a copy of your whole save folder.

Don't post the play recorder's recordings whole either: they hold every version of your hero save the game wrote while it ran. What can be sent is the copy Share this recording… shows, which leaves out the date, the time of day and where your saves are.

The editor itself never reads or changes the sign-in, entitlement and device-ID files. See How saves are stored.