Support

Hi!

I have never used JoomlaWatch. I always found it more convenient (and safer) to use Google Analytics. Without knowing what each PHP file you had to create an exception for is doing, I can't vouch for the security or lack thereof of this extension.

In any case, I would at least classify it as "suspicious security-wise". Needing six exceptions means that all of the tracking is done by PHP scripts that do not go through Joomla!'s index.php file. This means that if there is an SQL injections, XSS, CSRF, RFI, LFI or other vulnerability in any of those six files nothing will protect you (Admin Tools sits between the request and Joomla!, not between the request and any arbitrary PHP file).

So, my educated guess is that the extension is potentially insecure. My suggestion is to never skip an upgrade when one is offered, as any security vulnerability is very likely to cause a big problem if left unpatched for a few days.