I’m trying to figure out how to make and lua script login into a account with the name and password said into the script and then access the groups profits and do a payout to my devs.
I’m trying to make that, I’m. Making this so that if my devs can get paired per player. (There friends working for free but I’m. Being nice and don’t want to manually do it each time and want something to do it auto)
EDIT: If only the group owner can payout, then you could make a group with your bot account as the owner (or transfer ownership of a current group) and use this to payout.
That’s a general misconception, and I fully understand your cause for believing this. Many people think that using bots are insecure, simply because others have said so. More often than not, this is certainly not the case!
When developing a bot for Roblox, you need to take additional security measures in order to protect your system from getting breached. As Roblox doesn’t allow us to use API keys, we’re forced to use an account, which is extremely insecure, if someone gets a hold of the authorization cookie, almost anyone can get almost full access to account features.
But, the chances of someone randomly guessing your authorization is extremely low, and by extremely low, I mean seriously low. For someone to properly access your account they’d need (at minimum) to attempt more than 600^35 combinations! The reason for the bots’ undeserved reputation is that the ones creating the bot accounts are (either):
Not creating a strong, random password, with different symbols, numbers, capitalized letters etc.
Not setting up 2FA, or setting it up with poor security standards on the email account
(Accidentally) leaking the bot cookies on an external, public website, for example GitHub. (It happens more often than you’d think)
Sharing the cookie with others, that can again leak it.
Not hardening access to the hosting platform.
As long as you’re following proper security standards, both for coding and for your account, you shouldn’t really have an issue with this.
I’ve been running bots on my accounts to do general stuff like update many assets at one time and upload tons decals and stuff for years now. When it comes to bots, they’re safe. Especially when it comes to ones that you create your self and can view the source of.
Of course a file such as legit_group_bot.exe shouldn’t be trusted at all.
Unless running on your own device, that is unsafe. This is the same reason Rojo suggests you use a machine user for it’s automated Roblox tools (even though it’s on your device).
It seems to be like you don’t have a solid understanding how bots work. All bots are ran on your own device or on a server that you own. Bots just emulate requests to perform tasks, there is nothing un-safe about them.
All you’re doing is putting your cookie into to the script so it can run through the account, it’s only as insecure as you would be if someone accessed your computer, or your clicked on a malicious website.
If it’s your own code, and you keep the cookie safe, you’re fine.