Roblox security guides

When a remote sends a price, reward or damage value, the client decides it. How to send only the player's choice and look everything else up on the server.

A typeof check alone lets negative numbers, NaN and infinity through. How to write range checks for amounts, quantities and stock that reject all three.

Every argument after the player in OnServerEvent comes from the client. How to check types with typeof, use allowlists and reject bad values before they reach saved data.

Checking an Instance's class doesn't prove the player may use it. How to check a tool, part or model sent by the client belongs to that player.

A remote that spawns parts, plays effects or calls data stores can be fired far faster than any button. How to add a per-player cooldown on the server.

RemoteFunction:InvokeClient lets a client stall or break server code. How to replace it with two RemoteEvents and a timeout the server controls.

Checking that an id exists isn't the same as checking the player has it. How to check pets, skins, classes and zones against the player's own data.

Daily rewards, promo codes and quest prizes that pay out again on every call or rejoin. How to record claims in saved data before paying.

If the client reports hits and the server just applies damage, hits can land from anywhere. How to check range, cooldowns and ranged shots on the server.

A yield between a check and the change it guards lets the same remote pass the check twice. How to order handlers so the change happens first.

Chests, shops and sell pads that work from anywhere on the map. How to check on the server that the player's character is close enough to use them.

Building a data store key from a user id or slot the client sent lets one player read or overwrite another's data. How to build keys on the server.

Treating a failed load as a new player hands out default data, which is then saved over the real data. How to keep failed loads apart from new players.

Without a session lock, two servers can hold the same player's data and the later save wins. How session locking with UpdateAsync works.

GetAsync followed by SetAsync lets two servers overwrite each other's changes to a bank, counter or limited stock. How to use UpdateAsync and IncrementAsync instead.

Saving only in PlayerRemoving can lose data when a server closes. How to use BindToClose to wait for every save to finish.

Report buttons, vote-kicks and client anti-cheat that let one client punish another. How to keep punishment decisions on the server or with moderators.

Coins, checkpoints and finish lines that pay on Touched without checking the character is there. How to add distance checks and debounces on the server.

Admin panels that are only hidden on the client leave their remotes open to everyone. How to check the caller on the server in every admin handler.

An exploiter controls their own client, so checks that only run there can be switched off. How to move movement checks to the server.

Granting products from PromptProductPurchaseFinished or a client remote isn't reliable. Why every grant belongs in ProcessReceipt.

A ProcessReceipt that grants twice, or returns PurchaseGranted before saving, loses or repeats purchases. How to record PurchaseIds and grant exactly once.

Trusting the client, skipping pcall or checking only on join all break game pass perks. How to check ownership on the server and update it after a purchase.

ProcessReceipt is a single callback, so each script that sets it replaces the last. How to handle every developer product from one script.

require(id) loads code from outside your game that its owner can change at any time. How to find these calls and what to replace them with.

Running code from strings with loadstring lets whoever controls the string run code on your server. How to remove it and use data instead.

Code pushed off-screen, strings built from character codes and getfenv lookups are common signs of a backdoor. How to find them and clean them out.

Scripts inside models, parts and tools, often from free models, can create remotes or copy themselves. How to find them and check models before use.