VACWatch - Know Who You're Queued With

The Problem Statement

Steam will tell you whether an account is banned right now. What it won’t tell you is the shape of the thing: when the ban landed, what the account was called before, whether the person you’re about to queue with has a trail of freshly-minted accounts behind them.

That information is technically public and practically useless, because it’s only a snapshot. A profile checked today looks clean; the fact that it was named something else last month, or that three accounts in the same friend group got VAC’d the same week, is gone unless somebody was watching.

VACWatch watches. It keeps a case file on accounts over time so the history exists when you go looking for it.

The Solution

Add an account, and VACWatch tracks it: VAC bans, game bans, community and trade bans, and name history, refreshed on a schedule so changes get recorded when they happen rather than when you happen to check. Lists let you group the accounts you care about - a team, a friend group, the people you got matched with last night - and Discord notifications fire when something in a tracked list changes.

The framing matters more than the feature list. It’s a case file, not a shame board: the data is what Steam publishes, presented with the timeline intact.

Five Years, Two Rewrites

This is the oldest thing on this page. The first version went up in December 2020 as an Express app with Sequelize and Postgres, Passport for Steam sign-in, and EJS templates - then a separate Nuxt 2 frontend with Bootstrap-Vue and chart.js bolted on in 2022. It worked, and it accumulated five years of ban history that would have been genuinely painful to lose.

The current version is a ground-up rewrite that went live in 2026, which is why there’s a notice on the site explaining what changed and how to reclaim a tracked list. Migrating years of accumulated account history into a new data model without dropping any of it was most of the work, and none of it is the fun part.

Eating My Own Cooking

VACWatch’s billing runs on Guapocado - @guapocado/sdk, @guapocado/better-auth and the guap CLI, consumed as published npm versions like any other customer would.

That’s deliberate. The Discord ban alerts gate on an entitlement through Guapocado’s local read model, which means every hot-path entitlement check in a real app with real users runs through the same code path I’m asking other people to trust. When something in that SDK is awkward, I find out here first.

The Stack

• Astro rendering the site on Cloudflare Workers, with server islands for the live panels.
• Hono owning the /api/* routes inside the same Worker.
• Better Auth for sessions and social sign-in.
• Turso for application and auth data, through Drizzle ORM.
• A scheduled handler on the same Worker refreshing Steam account data on a cron trigger.
• Workspace packages - @vw/database, @vw/steam, @vw/discord, @vw/faceit - keeping the Steam integration and the web app on one domain model without coupling either to the other.
• Guapocado for billing and entitlements.