Can exploiters view source code in modules if they are never required?

[DevOfLua (Luka)]

@colbert2677

• A developer leaked content
• The source was stolen via a security vulnerability
• Exploits that existed before FilteringEnabled (though I doubt even this)
• A security fault or one of the developer

Someone said hackers used modulescript. I don’t know the id but when they executed the modulescript would’ve copied the whole game and placed the copy of the game in hackers desktop.

[colbert2677 (ImagineerColbert)]

That’s irrelevant and unsubstantiated. Even then, it doesn’t matter whether the code execution is facilitated through a ModuleScript or a code injection or whatever. ModuleScripts are just LuaSourceContainers meant to execute code on require. The point is the code, not the physical instance.

[OverHash]

No. It cannot copy objects placed in ServerStorage or ServerSciptService. Are you actually listening to any of the other developers on this thread explaining to you what the client can, and can’t access?

@colbert2677

Some games just have the script instances, they don’t have the code itself. If I had to guess:

• A developer leaked content
• The source was stolen via a security vulnerability
• Exploits that existed before FilteringEnabled (though I doubt even this)
• A security fault or one of the developer

It is one of those. That’s it. Nothing else. You are going off-topic talking about stealing games, I suggest you raise a new thread to ask a different question.

To answer your original question yes, exploiters can view source code in modules even if they are not required. You should change your framework if this is an issue.

[RuizuKun_Dev (Kitsune)]

If you are unsure of what can be seen by Server and Client you can simply “Start Test Server” and observe the explorer you will know exactly what is accessible by whom.

Exploiting Explained

Exploiting Explained: Second Revision This post is a general information source on common exploiting terminology, tools, and methods. The formatting is in sections for each specific topic, and is in no specific order. If you’re not aware of exploiting by this point, you’ve probably been living under a rock that the pioneers used to ride for miles. While Roblox is seen as open grounds for free reign of exploits, this isn’t the case, and I attempt to tackle this wrong assumption in this post. Th…

Very informative thread, have a read and it should cure your concerns.

My advice is let go of what ever is exposed to the Client, you aren’t in control of the security, Roblox is and I doubt that they would do something about.

[Monsieur_Joe2 (Habibi52)]

Sorry that this is 4 years later, but I’m curious. I have a ModuleScript in ServerScriptService and it holds the main and most important code in the game. Since it’s a ModuleScript, can exploiters gain access to it? Or they can’t because it’s in ServerScriptService?

[Phazezero9 (Comrade)]

No, they can’t access it because, as you said, it’s in ServerScriptService, which is only accessible by the server.

One way to check if a client has access to something is to try to find it while playtesting as a client.

If you were to place any instance, say a modulescript, into ServerScriptService as the server, then playtest as a client, you’d use explorer and find that the modulescript does not appear.

If the client’s explorer can’t find it, a client’s exploits can’t find it (except in VERY rare security breaches).