How to find scripts that prompt purchases you don't sell

What it looks like

A script, often inside a free model or plugin-added module, prompts players to buy an item, pass or product the game doesn't sell, or teleports them to a place outside the game. It usually runs on join or on a timer, with the id hidden in an attribute, a long table or an encoded string.

Players.PlayerAdded:Connect(function(player)
	task.wait(30)
	MarketplaceService:PromptPurchase(player, 2481935061)
end)

How to detect it

• –Find every PromptPurchase, PromptGamePassPurchase, PromptProductPurchase, PromptBundlePurchase and PromptSubscriptionPurchase call, on the server and the client.
• –For each one, find where the id comes from and compare it with what the game sells: its own passes, its developer products and its shop's item lists. An id that appears only in that one call, isn't in any shop table, or is built at run time is a finding.
• –Prompts that fire on join, on a timer, on every touch of a large part or from a script whose name has nothing to do with shopping are typical of backdoors. Real shops prompt when a player presses a buy button.
• –Find every TeleportService:TeleportAsync, Teleport, TeleportToPlaceInstance and TeleportToPrivateServer call and check the place id is one of the game's own places.
• –Ids that are decoded, fetched over HTTP or read from an outside asset are also Hidden or scrambled code, Server details sent to outside addresses or Module loaded by asset id; report the prompt or teleport here, and the loading under its own check.
• –Check the experience's **Allow Third Party Sales** and **Allow Third Party Teleports** settings in Studio's **Experience Settings > Security**. Roblox says these block sales of other creators' assets and teleports to games the owner doesn't own when they're off. If the audit can't see them, say they need checking.

What an exploiter could do

Whoever planted the script earns from the game's players. Robux spent on an asset or pass that belongs to someone else earns its owner a share of the sale. Teleports send players to another game, usually one run by whoever planted the script, and the game loses them. Players blame the game and stop trusting its real purchases.

How to fix it

• –Delete the script, and the model or plugin it came from, and check every other copy of it in the place.
• –Keep every id the game sells in one server-side table, and prompt only ids from that table.
• –Leave **Allow Third Party Sales** and **Allow Third Party Teleports** off unless the game really needs them.

Vulnerable example

local MarketplaceService = game:GetService("MarketplaceService")
local Players = game:GetService("Players")

local supportIds = { 1820356, 2241095, 3170642 }

local function thank(player: Player)
	for _, id in supportIds do
		task.wait(45)
		if player.Parent ~= Players then
			return
		end
		MarketplaceService:PromptGamePassPurchase(player, id)
	end
end

Players.PlayerAdded:Connect(thank)

Fixed example

local MarketplaceService = game:GetService("MarketplaceService")
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local passes: { [string]: number } = {
	Vip = 9100002,
	DoubleCoins = 9100001,
}

ReplicatedStorage.Remotes.PromptPass.OnServerEvent:Connect(function(player: Player, name: unknown)
	local passId = if typeof(name) == "string" then passes[name] else nil
	if passId then
		MarketplaceService:PromptGamePassPurchase(player, passId)
	end
end)

Common false positives

• –Selling other creators' avatar items on purpose, such as a UGC shop or a merch booth, is allowed when it's the game's design and **Allow Third Party Sales** is on for that reason. Check the ids are the shop's own list.
• –Teleports between places of the same experience, or to a partner game the team owns, are normal. Check the ids against the game's places.
• –A prompt for one of the game's own passes or products, shown when a player presses a buy button, is ordinary shop code.