Use an underscore for all non-Networked Custom Events

When declaring a Custom Event that is not a Custom Network Event, you should prefix the name of the Custom Event with an underscore _.

Example: If ToggleMirror is a Custom Event, name it _ToggleMirror instead. In UdonSharp, public method names are Custom Events, therefore public methods should begin with an underscore i.e. public void _ToggleMirror()

Reason: Malicious modded clients in an instance are able to invoke any Networked event on any Behaviour of the world. Many times, exposing a Custom Event is intended to be called locally from another UdonBehaviour using SendCustomEvent; not on the network, therefore you should always use an underscore on all Custom Event names except in the few cases where they are invoked with SendCustomNetworkedEvent.

VRChat documents what you cannot do as a world creator

The VRChat documentation contains guidelines that dictate the scope of Udon-powered moderation tools in terms of what you can and cannot do.

See: https://docs.vrchat.com/docs/udon-moderation-tool-guidelines