Report a VRA
security concern.

How to report

Email [email protected] with “VRA security report” in the subject. Include the affected public page or component, a concise description, the impact you observed and minimal steps to reproduce it. For a released VRA build, include its version if known.

Use only your own data or harmless examples. Remove passwords, access keys, private confirmation links, query strings, account names and other people’s information from screenshots or attachments. If sensitive evidence is unavoidable, describe it first and ask how to share it safely. Do not send live credentials.

Keep people and services safe

This is a reporting channel, not permission to conduct intrusive testing. Do not access another person’s records, bypass access controls, attempt denial of service, send unsolicited signup emails, or alter or delete data. If you encounter someone else’s information accidentally, stop and report the minimum detail needed to locate the issue; do not download more.

The website scope is vrabot.com. This page does not authorise testing of games, emulator vendors, unrelated Young Studio services, hosting networks or any other third-party system.

What happens next

Reports go to the existing Young Studio contact mailbox. Please keep vulnerability details out of public Discord channels and coordinate disclosure with us while the issue is assessed. We may ask for clarification or a reduced reproduction.

There is no published bug-bounty programme, guaranteed response deadline or payment offer. This page does not promise legal safe harbour, publisher approval, a security certification or a risk-free service. No public encryption key is currently advertised.

Support and privacy requests

For automation behaviour, setup questions or a failed action, use the support wiki and its troubleshooting checklist. For access, correction, removal or email opt-out requests, use the waitlist privacy notice or contact the same mailbox. Never include your game password.