Monetisation
How the game handles Robux purchases: developer products granted through ProcessReceipt, game pass and subscription checks, paid random items, and whether every purchase grants exactly what was bought, once, to the right player, and only after Roblox confirms it.
A remote that says an ad finished lets anyone skip the ad. Why ad prizes belong in ProcessReceipt, and how to use ShowRewardedVideoAdAsync correctly.
Why the server shouldn't check a game pass id the client sendscriticalUserOwnsGamePassAsync answers for any pass on Roblox. How to keep your own table of pass ids and let the client pick only which perk to check.
How to grant developer products the right waycriticalGranting products from PromptProductPurchaseFinished or a client remote isn't reliable. Why every grant belongs in ProcessReceipt.
Why ProcessReceipt should grant by ProductIdcriticalGranting the item a player picked before the prompt, instead of the product they paid for, lets them pay for a cheap item and get an expensive one. How to map products to rewards.
How to reward Robux transfers only when they completecriticalPromptRobuxTransferAsync only opens the prompt. How to grant thank-you rewards from the transfer receipt with BindReceiptHandler.
How to write a safe ProcessReceipt callbackcriticalA ProcessReceipt that grants twice, or returns PurchaseGranted before saving, loses or repeats purchases. How to record PurchaseIds and grant exactly once.
How to stop players dropping paid tools for otherswarningA paid tool that can be dropped can be handed to anyone, again and again. How to lock paid tools to the player who bought them.
How to check game pass ownership safelywarningTrusting the client, skipping pcall or checking only on join all break game pass perks. How to check ownership on the server and update it after a purchase.
Why ProcessReceipt must be set in one placewarningProcessReceipt is a single callback, so each script that sets it replaces the last. How to handle every developer product from one script.
How to check IsPaidItemTradingAllowed before players tradewarningTrading items bought with Robux, or with currency bought with Robux, needs a PolicyService check for each player. How to add it on the server.
How to handle paid random items and PolicyServicewarningCrates, eggs and spins bought with Robux or Robux-bought currency must respect ArePaidRandomItemsRestricted. How to check it on the server and show odds.
Why you shouldn't reward players for looking at adswarningPaying players to stand by billboards or walk through ad portals inflates impressions, which can cost your ad earnings. What Roblox allows instead.
How to grant Roblox subscription perks correctlywarningSubscription perks saved forever, checked once or trusted from the client. How to check GetUserSubscriptionStatusAsync on the server and keep perks in step.
How to show sponsored content only to players who can see adswarningAds you place yourself must be hidden from players whose AreAdsAllowed is false. How to check PolicyService before showing them.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.