RM stores Roblox .ROBLOSECURITY cookies — the most sensitive credential a Roblox account has. We take reports about how those secrets are stored, transmitted, or exposed seriously.

Please do not open a public issue for security problems.

Report privately through GitHub's private vulnerability reporting (open a draft advisory), or email the maintainers.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (or a proof of concept).
• The RM version (Help → About or the window title) and your OS version.

We aim to acknowledge reports within a few days.

In scope:

• Weaknesses in cookie/master-password storage or encryption.
• Secrets leaking to disk, logs, other processes, or the network.
• Anything that lets one account's data be attributed to another.

Out of scope:

• The multi-instance mutex technique's Roblox ban risk. This is a documented, opt-in trade-off, not a vulnerability in RM — see the README disclaimer.
• Attacks that require an attacker who already has code execution or read access as the same OS user (RM's threat model is a single trusted local user; secrets are protected at rest, not against a compromised account).

If you contribute, keep these invariants:

• Never log a .ROBLOSECURITY cookie or the master password, at any log level.
• Cookies are only ever persisted encrypted (AES-256-GCM, Argon2id-derived key) or in the OS credential store.
• Zeroize decrypted cookies and the master password when practical.