Server compromise, privileged account takeover, or broad access to private data.
Security research
Find it.
Report it.
Found a real security issue in an LTD VVV system? Show us the impact responsibly and we will take it seriously.
Privilege escalation, meaningful authorization bypass, or sensitive data exposure.
Reproducible state-changing issue with realistic security impact.
Limited but valid security impact that improves the protection of the service.
01 / Website
Web application
We accept reproducible XSS, authentication and session flaws, IDOR or other authorization bypasses, CSRF with meaningful impact, SSRF, sensitive data exposure, and server-side request or access-control issues.
Show impact with your own account and minimal data. Do not dump private records, scan aggressively, or test availability.
02 / Roblox
Game systems
We accept server-side validation failures in RemoteEvents or RemoteFunctions, economy and inventory abuse, unintended privilege changes, data integrity issues, and server trust-boundary mistakes in LTD VVV games.
RCE: only a confirmed server-side code-execution issue with a harmless proof of impact is in scope. Do not submit exploit scripts, execute code in live games, target other players, or attempt account theft.
In scope
zaovvv.com, its public API, authentication, sessions, role permissions, forms, and LTD VVV systems explicitly linked from this domain.
Keep it safe
Use your own accounts and data. Do not disrupt availability, use social engineering, access unrelated accounts, retain private data, or continue after proving impact.
What qualifies
The first reproducible report for an unknown issue may qualify. The final severity and reward are decided after validation based on actual impact and reliability.
Not rewarded
Duplicates, automated scan output without proof, theoretical issues, self-XSS, missing headers without an exploit, third-party Roblox bugs, spam, and denial-of-service testing.
Private channel
Send the signal.
No account is required. Contact details are optional. Give us enough detail to reproduce the issue without collecting or exposing anyone else's data.
Response targetReceipt within 5 business days. Triage normally within 15.
The Roblox scope covers only LTD VVV games published on the Roblox platform. roblox.com, Roblox accounts, platform services, and third-party games are not LTD VVV assets and are outside this program. Do not disclose an unresolved issue publicly.