Security fixes target the latest release. Update to the latest version before checking whether a reported issue is still present.

Use GitHub's private vulnerability report. Include the affected app/module versions, reproduction steps, impact, and a small synthetic example when possible. Keep exploit details and private data out of public issues. Remove credentials, avatar IDs, usernames, and network addresses from attached logs or screenshots.

A module ZIP contains executable code. Import modules only from publishers you trust. Modules run with your Windows account's permissions; the separate tracking worker supports reliable restarts and is not a security sandbox. Archive format checks do not establish publisher trust. Each module and any required headset software remain subject to their own licenses and security updates.

The app does not require your VRChat password or a GitHub access token.