Backdoors
Code that lets someone outside the team run things in the game: modules loaded from the Roblox catalogue by id, code run from strings, hidden or scrambled scripts, and scripts tucked inside models, often from the Creator Store, that do more than the model needs.
Back to categoriesrequire(id) loads code from outside your game that its owner can change at any time. How to find these calls and what to replace them with.
Why loadstring is a backdoor risk in RobloxcriticalRunning code from strings with loadstring lets whoever controls the string run code on your server. How to remove it and use data instead.
How to find scripts that prompt purchases you don't sellcriticalFree models can prompt players to buy someone else's items or teleport them to another game. How to find these prompts and lock down third-party sales and teleports.
How to find hidden admin backdoors in your gamecriticalFree models that give commands to their maker's UserId or group, or add a second handler to your staff remotes. How to find them and remove them.
How to find backdoor remotes hidden in modelscriticalSome free models create their own remotes that let anyone change or delete your game. How to spot them and where remotes should live.
How to spot hidden or obfuscated code in your gamecriticalCode pushed off-screen, strings built from character codes and getfenv lookups are common signs of a backdoor. How to find them and clean them out.
How to spot scripts sending your server details elsewherewarningScripts that post your JobId, PlaceId and player list to outside addresses help backdoor makers find your servers. How to find these requests and remove them.
The risks of loading models by id while the game runswarningA model loaded at runtime brings whatever scripts its latest version holds. How to keep maps in the place file or load them sandboxed.
How to find scripts hidden in free modelswarningScripts inside models, parts and tools, often from free models, can create remotes or copy themselves. How to find them and check models before use.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.