Text and chat
How the game handles text players write for each other: names, signs and messages filtered with TextService before anyone else sees them, conversations sent through TextChatService rather than the game's own remotes, chat styling and actions that don't trust what the sender's client attached, and public text that can't be changed more than once a minute.
Chat between players must go through a TextChannel, even if you filter it. How to build whispers and party chat that respect players' settings.
How to filter player text in Roblox with TextServicecriticalPet names, signs and plot names typed by players must be filtered before others see them. How to use FilterStringAsync and the right TextFilterResult method on the server.
How often players should be able to change a signwarningRoblox requires at least a minute between changes to text other players can see. How to rate limit signs and boards on the server.
Why chat tags shouldn't come from message metadatawarningAny client can set a chat message's metadata, so staff tags based on it can be faked. How to decide tags from the sender instead.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.