Use when writing Roblox game scripts that handle player actions, currencies, stats, damage, or any RemoteEvent/RemoteFunction communication. Use when reviewing code for exploitable patterns, implementing anti-cheat logic, validating client requests on the server, or setting up rate limiting.

Roblox Security: Anti Exploit & Server Side Validation Core Principle Never trust the client. Every LocalScript runs on the player's machine and can be modified. All authoritative logic — damage, currency, stats, position changes — must live on the server. FilteringEnabled is always on in modern Roblox. Client side changes do not replicate to the server or other clients unless the server explicitly applies them. Secure vs Insecure Patterns Pattern Insecure Secure Dealing damage LocalScript sets Humanoid.Health Server reduces health after validation Awarding currency LocalScript increments leaderstats Server validates action, then increments Leaderstats ownership LocalScript owns the IntValue Server creates and owns all leaderstats Position changes LocalScript teleports character Server validates and moves character Tool use Client fires damage on hit Server raycasts and applies damage Cooldowns Client tracks cooldown locally Server tracks cooldown per player Secure Leaderstats Setup Server Side Sanity Checks Distance Check Cooldown Validation Stat Bounds Check Rate Limiting Argument Validation Utility Speed / Anti Cheat Detection ModuleScript Placement Never put currency, damage, or DataStore logic in ReplicatedStorage modules — clients can require() them. Common Mistakes Mistake Why It's Exploitable Fix FireServer(damage) with server trusting it Client sends any value Server calculates damage from its own tool data Currency in LocalScript variable Client can modify memory Server owned only Client side distance check before firing Check is bypassable Server re checks after receiving event No cooldown on RemoteEvent handlers Spam = infinite resources Per player cooldown on server Trusting WalkSpeed set by client Client sets arbitrarily high Server owns and caps WalkSpeed Sensitive logic in ReplicatedStorage module Clients can require it Move to ServerScriptService

roblox-security