does VAC work anymore?

As long as the hacks aren't old, you won't have to worry about getting banned. It still looks for and bans very simple hacks, but any modern hacks just easily bypass VAC. Especially ones that just execute lua files client-side.