Roblox security guides

When a remote sends a price, reward or damage value, the client decides it. How to send only the player's choice and look everything else up on the server.

Pet names, signs and plot names typed by players must be filtered before others see them. How to use FilterStringAsync and the right TextFilterResult method on the server.

A typeof check alone lets negative numbers, NaN and infinity through. How to write range checks for amounts, quantities and stock that reject all three.

Every argument after the player in OnServerEvent comes from the client. How to check types with typeof, use allowlists and reject bad values before they reach saved data.

Checking an Instance's class doesn't prove the player may use it. How to check a tool, part or model sent by the client belongs to that player.

A remote that spawns parts, plays effects or calls data stores can be fired far faster than any button. How to add a per-player cooldown on the server.

Anything sent to a client or left in ReplicatedStorage can be read. How to send each player only what they're allowed to know.

RemoteFunction:InvokeClient lets a client stall or break server code. How to replace it with two RemoteEvents and a timeout the server controls.

An unanchored part near a player is simulated by their client. How to stop balls, crates and carts deciding rewards from client physics.

TeleportData passes through the client, even with a SourcePlaceId check. How to carry coins, boosts and entry fees between places safely.

Bets after the winner is known and answers after the reveal. How to keep round and player state on the server and check it in every handler.

Checking that an id exists isn't the same as checking the player has it. How to check pets, skins, classes and zones against the player's own data.

Daily rewards, promo codes and quest prizes that pay out again on every call or rejoin. How to record claims in saved data before paying.

If the client reports hits and the server just applies damage, hits can land from anywhere. How to check range, cooldowns and ranged shots on the server.

A yield between a check and the change it guards lets the same remote pass the check twice. How to order handlers so the change happens first.

Chests, shops and sell pads that work from anywhere on the map. How to check on the server that the player's character is close enough to use them.

Building a data store key from a user id or slot the client sent lets one player read or overwrite another's data. How to build keys on the server.

Treating a failed load as a new player hands out default data, which is then saved over the real data. How to keep failed loads apart from new players.

Without a session lock, two servers can hold the same player's data and the later save wins. How session locking with UpdateAsync works.

Data store keys built from a player's name or display name break when they change it, and display names aren't unique. How to key saves by UserId instead.

GetAsync followed by SetAsync lets two servers overwrite each other's changes to a bank, counter or limited stock. How to use UpdateAsync and IncrementAsync instead.

Granting coins or items inside an UpdateAsync callback can pay twice when the write fails. How to keep the callback pure and grant after it succeeds.

Saving on every coin, kill or second played uses up the server's data store budget and gets saves dropped. How to keep values in memory and save on a timer.

Builds, drawings and lists with no cap can grow past the 4 MB limit and stop a profile saving. How to cap and bound what players add to saved data.

Saving only in PlayerRemoving can lose data when a server closes. How to use BindToClose to wait for every save to finish.

Report buttons, vote-kicks and client anti-cheat that let one client punish another. How to keep punishment decisions on the server or with moderators.

Coins, checkpoints and finish lines that pay on Touched without checking the character is there. How to add distance checks and debounces on the server.

Admin panels that are only hidden on the client leave their remotes open to everyone. How to check the caller on the server in every admin handler.

An exploiter controls their own client, so checks that only run there can be switched off. How to move movement checks to the server.

Bans kept in a script table or saved by username don't stop anyone for long. How to use Players:BanAsync or save bans by UserId.

Granting products from PromptProductPurchaseFinished or a client remote isn't reliable. Why every grant belongs in ProcessReceipt.

Granting the item a player picked before the prompt, instead of the product they paid for, lets them pay for a cheap item and get an expensive one. How to map products to rewards.

A ProcessReceipt that grants twice, or returns PurchaseGranted before saving, loses or repeats purchases. How to record PurchaseIds and grant exactly once.

Trusting the client, skipping pcall or checking only on join all break game pass perks. How to check ownership on the server and update it after a purchase.

ProcessReceipt is a single callback, so each script that sets it replaces the last. How to handle every developer product from one script.

Crates, eggs and spins bought with Robux or Robux-bought currency must respect ArePaidRandomItemsRestricted. How to check it on the server and show odds.

Subscription perks saved forever, checked once or trusted from the client. How to check GetUserSubscriptionStatusAsync on the server and keep perks in step.

require(id) loads code from outside your game that its owner can change at any time. How to find these calls and what to replace them with.

Running code from strings with loadstring lets whoever controls the string run code on your server. How to remove it and use data instead.

Free models that give commands to their maker's UserId or group, or add a second handler to your staff remotes. How to find them and remove them.

Code pushed off-screen, strings built from character codes and getfenv lookups are common signs of a backdoor. How to find them and clean them out.

Scripts that post your JobId, PlaceId and player list to outside addresses help backdoor makers find your servers. How to find these requests and remove them.

Scripts inside models, parts and tools, often from free models, can create remotes or copy themselves. How to find them and check models before use.