Menu
Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when implementing Roblox character animations, particles, beams, trails, tweens, camera shake, or other visual effects.
Use when building Roblox menus, HUDs, shops, notifications, dialogs, or responsive cross-platform UI.
Use when handling Roblox keyboard, mouse, gamepad, touch, motion input, or cross-platform action binding.
Use when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
Use when creating Roblox NPCs or enemies with pathfinding, state machines, line-of-sight or FOV detection, spawns, or AI update loops.
Use when building Roblox vehicles, ragdolls, projectiles, elevators, constraints, forces, or other physics-driven gameplay.
| name | roblox-security |
| description | Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows. |
| last_reviewed | "2026-07-13T00:00:00.000Z" |
| sources | ["https://create.roblox.com/docs/scripting/security/security-tactics","https://create.roblox.com/docs/scripting/security/client-server-boundary","https://create.roblox.com/docs/projects/server-authority","https://create.roblox.com/docs/projects/server-authority/techniques"] |
Load for exploit audits and hardening. Covers classic replication, opt-in Server Authority, remote abuse, economy attacks, and DataStore flows. Use roblox-networking for validation and rate-limit implementations.
Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.
Workspace.AuthorityMode = Server and its required settings, the server owns core simulation while clients predict and recover from misprediction. Use BindToSimulation(), not blanket Heartbeat CFrame correction.| Vector | Attack | Fix |
|---|---|---|
| Movement | Custom dash, teleport, or locomotion abuse | Server state and transition checks; under Server Authority, keep simulation logic in BindToSimulation() and do not add blanket CFrame snap-back |
| Remote | Spam, arg spoof, replay | Rate limiter + validate arg types + idempotency |
| Economy | Dupe, negative qty | Session lock, atomic ops, qty > 0 |
| DataStore | Save spam, session hijack | Server-controlled saves, JobId session lock |
| General | Client trusts values | Server computes ALL game state |
CRITICAL: Server-authoritative state · Choose and document the authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client or replicated code
HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects
MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering
Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.
See references/full.md for detailed examples.