Your code
What Luaudit can and can't see
Luaudit is a set of security checks your AI follows. Your AI reads your game, not us. Whether your scripts ever reach Luaudit depends on how you let your AI read them, and that's your choice.
Luaudit never sees your code
Your AI reads your game itself
- How it works
- Your AI reads your scripts through Roblox Studio's own MCP server or your Rojo project files, or you paste them into a chat. Luaudit only hands it the checks, the audit guide and the report format. The plugin's Export as text works the same way: the text stays in the plugin window until you copy it.
- What reaches us
- Your AI's requests for checks, which carry no code. Our server logs only the tool, the time and which key was used.
- Good to know
- Your AI provider still reads your code, under its own privacy terms.
Encrypted, 15 minutes at most
The Luaudit plugin, to your AI
- How it works
- The plugin sends your place's scripts only when your AI asks for them with your Luaudit key. They wait encrypted with a key worked out from yours, so only requests carrying it can read them, and they're deleted within 15 minutes.
- What reaches us
- Your scripts and remotes with their paths, on their way to your AI. Never anything from Studio's own services, so your other plugins' scripts aren't sent.
- Good to know
- We never log your scripts, look at them or share them. Disconnect the plugin and nothing more is sent.
Sent to Anthropic for that audit
Hosted audits
- How it works
- When you start an audit on luaudit.com or in the plugin, the plugin sends your scripts. They're kept for up to 15 minutes, encrypted with a key only our server holds for that audit, and sent with our checks to Anthropic's API, which runs the audit with Claude.
- What reaches us
- Your scripts, for that audit. The report goes to your browser and we don't keep it. For an audit started in the plugin, its progress and report wait in the same store, encrypted the same way, until you close the report or 15 minutes after the audit ends. While the plugin is connected, which place you have open (its ID and name, never its scripts) for about 20 seconds.
- Good to know
- Anthropic's commercial terms don't let it train its models on your scripts. It keeps API data for a limited time to run its service and check for misuse, and its privacy centre says for how long.
Off until you turn it on
Apply fix in the plugin
- How it works
- The plugin only reads your place. Apply fix only appears after you turn on Allow edits, which is off by default. Each fix shows the current lines next to the new ones, and nothing changes until you click Apply. Undo puts the old lines back.
- Good to know
- Luaudit's server can't change your game. Every edit is made by the plugin in your Studio, one fix at a time, after you click.
Whichever way you choose
- Our server logs the time, the tool and which key was used. Never your code or what an audit found.
- We never sell your data, and we never use it to train AI models.
- We never share your code with anyone, apart from Anthropic for a hosted audit you start.
- You can delete your account from your dashboard at any time.
Rather nothing reached us?
Connect your game through Studio's MCP server or a Rojo project instead of the plugin. Your AI reads your scripts itself and Luaudit only hands it the checks.