[cashpath]

This is just a thought.. but wouldn't some sort of user agreement along these lines solve this problem.

"Author agrees any mod posted to vb.org will remain on vb.org and will not be removed. Author also agrees that if the hack is not being supported by the author and is found to have vulnerabilities, vb.org will allow other authors to fix those vulnerabilities in the code and re-release with no other modifications".

You could go on to allow the author to checkbox if they would like to allow thier code to become open source in the event they abandon it for more than a period of xx days. Now obviously some Authors might not check this box but some would.

Is this not something that could be done? (Of course this won't help in the case of vbbux/vbplaza, but it could save future similar problems)

Oh.. one last thing... while I understand not POSTING the vulnerabilities found for everyone to see. Could vb.org at least send in the email sent to all people who have the hack installed exactly what the vulnerabilities are?