The attention economy is engineered to exploit kids' undeveloped self-regulation. Professional behavioural psychologists are paid to defeat your child's self-control. The infinite scroll, the variable-ratio reward schedules, the loot boxes, the "you're on a streak" guilt trips - none of that is accidental.
Unrot is a small, free counter-weapon. It teaches the same dopamine brain how to earn its rewards, and it teaches the whole family that a kid's careless click can cost a parent's job.
Unrot is an open-source platform with a growing gallery of honest fake-cheat installers. Each installer looks to a kid like the cheat they were about to Google for. Under the cursed branding, each one is a parental control app that:
- Walks the kid through an honest, non-skippable EULA explaining that what they just "installed" is exactly how real malware gets onto computers - with the April 2026 Vercel / Context.ai breach as the real-world lesson
- Hands control to a shared Windows tray app that blocks Fortnite, Steam, Epic Games Launcher, and Roblox until the kid earns minutes by answering study questions on a quiz PWA
Status: v1 in active development. First installer: V-Bucks Unlocker. More in the gallery coming. See ROADMAP.md. For released-version changes see CHANGELOG.md.
License: MIT. No telemetry. No analytics. No email capture. No ads. No monetisation. Ever.
Brand: Unrot (the wordmark). The primary domain, unrot.you, reads as an imperative phrase.
Hard work, then play. Like life is supposed to work.
- Kids learn. Real curriculum-aligned questions. Effort earns screen time.
- Kids learn about security. The install UX teaches them that a careless click can leak their parent's work credentials and get the parent fired.
- Kids learn about effort→reward. The opposite of what most apps teach them.
- Free and open source. MIT licensed. No monetisation. No telemetry. No ads. Ever.
- Runs on your infrastructure. Your Supabase project. Your data. We can't see any of it.
Truth 1: The attention economy is designed to break kids' self-regulation.
Children's prefrontal cortexes - the part of the brain responsible for impulse control, planning, and delayed gratification - don't finish developing until around age 25. Game companies know this. Social media companies know this. Their entire business model depends on it. Every time a 10-year-old opens Fortnite's shop, variable-ratio reinforcement schedules (the same mechanism that makes slot machines addictive) are being deployed against the least-developed part of their brain by teams of PhD behavioural psychologists on adult salaries.
The problem isn't that kids "lack willpower". The problem is that it's not a fair fight.
Truth 2: A kid's click can destroy a parent's career.
In April 2026, Vercel - one of the biggest cloud platforms on the internet - had to notify customers of a breach that started with a single person downloading a Roblox auto-farm script on a work laptop. That script was Lumma Stealer malware. It harvested the employee's Google Workspace session. Ten weeks later, attackers were demanding $2 million in ransom.
Multiply that by every work-from-home parent with a child who uses the same machine. If your kid downloads a cheat and it's malware, and your work Google account is signed in on that machine, the attacker has your employer's data. Under most employment contracts, that's a fireable offence. Not for your kid. For you.
Build a small, free platform that:
- Teaches kids that effort precedes reward. The quiz turns study questions into the currency for game time.
- Teaches kids that cheats are malware. Every installer is a deliberate, well-reasoned teaching moment about one specific real-world threat.
- Gives parents a tool without making them adversaries. The blocker is honest and overridable. The goal isn't to outsmart your kid; it's to reshape the incentive gradient they're already on.
Kids search Google for what they want. A Roblox-only kid will never download a V-Bucks Unlocker - but they'll absolutely try a free Robux generator. A Minecraft kid won't click either, but they're genuinely at risk from backdoored Java mod menus. A teen is at risk from Discord Nitro generators and pirated game keygens.
Unrot is therefore a catalog of fake-cheat installers, each targeting a specific at-risk kid demographic with a specific real-world threat vector. v1 ships one. More are coming.
See GALLERY.md for the public catalog. See INSTALLERS.md if you want to build one.
Rough catalog (prioritised by real-world threat prevalence):
| Installer (working name) | Target | Threat taught | Status |
|---|---|---|---|
| V-Bucks Unlocker | Fortnite players (7–14) | Infostealer malware + OAuth supply chain | v1 (now) |
| Free Robux Generator | Roblox players (6–12) | Same family - literally the Vercel vector | v1.2 |
| Minecraft Mod Menu Pro | Minecraft kids (7–13) | RATs, backdoored Java mods | v1.2+ |
| Discord Nitro Generator | Teens (13+) | Token theft, session hijacking | v1.2+ |
| PC Game Pirate Keygen | Gamer teens (12+) | Crypto miners, RATs in cracks | v1.2+ |
| AI Image Generator (Uncensored) | Curious teens (12+) | Malicious Python packages, AI tooling backdoors | v1.2+ |
| EA FC Coin Generator | Sports game kids (10–16) | Account theft | v1.2+ |
| GTA Online Money Drop Tool | Teens (13+) | Session theft, RCE via console exploits | v1.2+ |
| Spotify Premium Cracked | Teens (13+) | Cracked-software bundling, credential harvesting | v1.2+ |
| School Answer Key Generator | Any student (10–18) | Fake edtech scams | v1.2+ |
git clone https://github.com/0800tim/unrot.git
cd unrot
pnpm install
# Set up Supabase (free tier is plenty):
# 1. Create a project at https://supabase.com
# 2. Paste platform/supabase/SCHEMA.sql into the SQL editor, run
# 3. Paste platform/supabase/seed.sql, run (20 NCEA Level 1 seed questions)
# 4. Copy your project URL and anon key + the `kid_id` from the kids table
# Run the quiz PWA:
cp platform/quiz/.env.example platform/quiz/.env.local
# Fill in NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, NEXT_PUBLIC_KID_ID
pnpm dev:quiz
# → http://localhost:3000
# On Windows, build the blocker + installer:
# See platform/blocker/README.md and installers/vbucks-unlocker/README.mdFor full setup, see docs/getting-started.md.
Right now, running Unrot requires comfort with Node.js, .NET, and Supabase. That is a real barrier and we know it. v2 aims to close it. If you want to use this with your kid and you are not a developer, you have three options today:
- Find a developer friend. This is a fun weekend project for them.
- Wait for v2. We are planning a hosted version for non-technical families.
- Help us build it. Open a discussion on GitHub if you would like to fund or organise the hosted version.
Unrot is hosted (unrot.you) so non-technical parents can actually use it. We run the service; we aim for the smallest footprint of personal data that still lets the app work.
What we store:
- Parent: email (for magic-link sign-in) + first name (for the dashboard greeting). That is all.
- Kid: a nickname the parent picks (never their real name unless the parent types it), a year level for question selection, and quiz answers + earned/spent minutes linked to an anonymous kid ID. No email, no age beyond year level, no school, no location, no device fingerprint.
What we never do:
- No analytics. No telemetry on kids or games. No advertising. No third-party scripts on kid-facing pages. No cross-site tracking. No selling or sharing your data with anyone.
If you want zero data on our servers, self-host. The code is MIT-licensed and docs/setup/for-technical-parents.md walks you through running Unrot entirely on your own Supabase project + your own infra. Same features, same privacy posture, your data stays with you.
PRs welcome. Read CONTRIBUTING.md before your first PR. Core values:
- Open source, MIT. No proprietary forks for commercial use without also being MIT.
- No telemetry, ever.
- Accessibility is not optional.
- Internationalisation: every UI string in a locale file, not hardcoded.
We explicitly want contributors to build new fake-cheat installers. See INSTALLERS.md for the contributor spec - the ethics checklist, the template repo structure, and the review criteria.
Start here:
- README.md - this file
- ROADMAP.md - v1 → v3 feature plan
- GALLERY.md - the public installer catalog
- INSTALLERS.md - how to contribute a new installer
- CONTRIBUTING.md
- CODE_OF_CONDUCT.md
- SECURITY.md
- AGENTS.md - AI-agent context (vendor-neutral)
- docs/ - architecture, setup, workflows, build log, handover provenance
Built by Tim Thomas (Growth Spurt Agency, Auckland NZ) with substantial help from Claude. Inspired by the Context.ai / Vercel supply-chain breach of April 2026 - a reminder that the chain is only as strong as its most casual click.
MIT. Do what you want, just don't blame us.
✨ FREE V-BUCKS ✨