Only the latest GitHub release and the exact Scrap Mechanic build named in its release notes are supported.

Do not publish access tokens, private keys, personal data, or a working exploit in a public issue. Use GitHub's private vulnerability-reporting or Security Advisory flow for the repository. Include the affected release, impact, reproduction conditions, and a minimal proof of concept.

The project will never request a Steam password or modify ScrapMechanic.exe, Steam ownership files, DRM, anti-cheat, or save games. Report any release that appears to do so immediately.

Release assets are currently unsigned. Verify ScrapMechanicVR-Patcher.exe against the SHA-256 value in the matching release's SHA256SUMS.txt.