Legendry code editor + download



First of all, I apologize for making the download path long. I want to give you a community explanation with the source.
Why should we use this code editor? The high speed of this code editor can execute 100 thousand lines of code with less than 200 MB of RAM and most importantly, it has 100 algorithms to detect dangerous and unoptimized code and can detect obsolete code, which are the main reasons to download this code editor.
The next point is the outline section, which shows you the functions so that you can see the skeleton of your project.
If you have any ideas or suggestions, you can tell me here so that I can read and implement them.

  1. :rocket: Roblox Luau Script Analyzer

  2. A powerful static code analysis system for Roblox Studio / Luau that analyzes scripts line by line and identifies issues related to Performance, Best Practices, Deprecated APIs, Potential Errors, Security Risks, and Obfuscation.

  3. :high_voltage: Performance & Best Practices

  4. The analyzer checks for the following patterns and potential issues:

    • :small_blue_diamond: Detects the use of wait() and recommends task.wait()
    • :small_blue_diamond: Detects infinite while true do loops that do not contain task.wait() or wait() and may cause excessive CPU usage or freezing
    • :small_blue_diamond: Detects repeat ... until false loops without a yielding mechanism
    • :small_blue_diamond: Checks Event Connections created with :Connect() that may not have a corresponding :Disconnect()
    • :small_blue_diamond: Detects deeply nested and direct Instance access and recommends FindFirstChild() to reduce potential nil errors
    • :small_blue_diamond: Recommends using game:GetService() instead of directly accessing services such as game.Workspace and game.ReplicatedStorage
    • :small_blue_diamond: Recommends ipairs() for array-like Tables instead of pairs()
    • :small_blue_diamond: Detects the use of error() without appropriate error handling such as pcall() / xpcall()
    • :small_blue_diamond: Analyzes Instance.new() usage and recommends caching/configuring the Instance before assigning its Parent
    • :small_blue_diamond: Checks TweenInfo.new() calls for missing or unspecified parameters
    • :small_blue_diamond: Analyzes UserInputService:BindAction() usage and recommends more appropriate input-handling approaches where applicable
    • :small_blue_diamond: Checks MeshPart creation and warns about potential Collision configuration issues
    • :small_blue_diamond: Detects expensive math.* operations inside loops
    • :small_blue_diamond: Detects Promise.new() usage and recommends handling failures with :Catch()
    • :small_blue_diamond: Recommends PathfindingService instead of Workspace:MoveTo() for Humanoid movement where appropriate
    • :small_blue_diamond: Detects the use of BodyVelocity on HumanoidRootPart
    • :small_blue_diamond: Checks Part objects created with Instance.new("Part") when CanCollide is not explicitly configured
    • :small_blue_diamond: Detects direct CFrame assignments and may recommend TweenService for smoother movement
    • :small_blue_diamond: Checks direct use of Touched on Humanoids
    • :small_blue_diamond: Detects multiple string.split() calls on the same line and recommends splitting once and reusing the result
    • :small_blue_diamond: Checks Debounce variables and recommends making them local where appropriate
    • :small_blue_diamond: Detects UI element access without nil checks
    • :small_blue_diamond: Detects multiple task.wait() calls on the same line
    • :small_blue_diamond: Recommends task.spawn() instead of spawn()
    • :small_blue_diamond: Recommends task.delay() instead of delay()
    • :small_blue_diamond: Recommends task.defer() instead of defer()
    • :small_blue_diamond: Detects game:GetObjects() usage and recommends newer API approaches where applicable
    • :small_blue_diamond: Detects WaitForChild() without a timeout and warns about potential Infinite Yield
    • :small_blue_diamond: Checks LoadAnimation() usage before confirming that an Animator exists
  5. This section is directly implemented through a collection of dedicated Performance / Best Practice rules.


  6. :puzzle_piece: Deprecated Roblox API Detection

  7. The analyzer also detects the use of older or deprecated Roblox APIs and syntax, including:

  8. The analyzer also performs dedicated checks for:

    • :small_blue_diamond: Numeric indexing of Enum values
    • :small_blue_diamond: Invalid or deprecated usage of Instance.new("DataModel")
    • :small_blue_diamond: Various legacy APIs and syntax patterns, including replacement recommendations
  9. Deprecated Roblox APIs are implemented as independent analyzer rules, allowing them to be detected and reported separately.


  10. :shield: Security & Obfuscation Detection

  11. One of the major components of the analyzer is the detection of suspicious security-related patterns, exploit indicators, runtime manipulation, and code obfuscation techniques.

  12. The system detects patterns such as:

    • :red_circle: debug.traceback
    • :red_circle: debug.getupvalue
    • :red_circle: debug.setupvalue
    • :red_circle: debug.sethook
    • :red_circle: hookfunction()
    • :red_circle: bit32.*
    • :red_circle: os.execute()
    • :red_circle: io.popen()
    • :red_circle: writefile()
    • :red_circle: readfile()
    • :red_circle: getgenv()
    • :red_circle: Global variables named shared
    • :red_circle: loadstring()
    • :red_circle: loadfile()
    • :red_circle: getfenv()
    • :red_circle: setfenv()
  13. The analyzer also detects more complex patterns.

  14. :globe_with_meridians: Remote Code Execution Patterns

    • Detects combinations of HttpGet() + loadstring()
    • Detects require() combined with HttpGet()
    • Identifies code retrieved from remote sources and dynamically executed at runtime
  15. :locked_with_key: Obfuscation Detection

  16. The analyzer can detect:

    • Suspicious use of select() combined with variadic unpacking (...)
    • wait(math.random(...)) as a potentially suspicious or obfuscated delay pattern
    • Extremely long strings containing excessive escape sequences
    • Unicode escape sequences such as \uXXXX
    • Hex escape sequences such as \xXX
    • loadstring(string.char(...))
    • pcall(loadstring(string.char(...)))
    • Combinations of __index and rawget
    • __call overrides using setmetatable
    • __metatable overrides using setmetatable
    • task.spawn() combined with repeat ... until false loops
  17. These checks are designed to identify potential exploit behavior, dynamic code loading, runtime manipulation, and obfuscation patterns.

  18. :warning: Important: A security warning does not automatically mean that the code is malicious. These patterns may have legitimate uses, so human review is still recommended.


  19. :brain: Context-Aware Analysis

  20. The analyzer does not rely exclusively on isolated line-by-line pattern matching.

  21. For certain rules, the system can analyze:

    • :small_blue_diamond: Lines before the current line
    • :small_blue_diamond: Lines after the current line
    • :small_blue_diamond: Larger sections of the current code block
    • :small_blue_diamond: Structures such as do ... end
    • :small_blue_diamond: function ... end
    • :small_blue_diamond: then ... end
    • :small_blue_diamond: repeat ... until
  22. This allows certain warnings to be generated based on the context surrounding the code, rather than simply matching an individual pattern on a single line.


  23. :broom: Smart Comment & String Handling

  24. Before executing many of its rules, the analyzer processes the source code to reduce false positives.

  25. It can:

    • Ignore the contents of Strings during normal analysis
    • Mask single-line comments
    • Preserve the original line length so Pattern locations remain unchanged
    • Prevent normal rules from triggering on patterns found inside Comments or Strings
  26. However, Security rules intentionally analyze certain patterns on the Raw Line, allowing potentially suspicious patterns hidden inside Strings to still be detected.


  27. :gear: Robust Analysis Engine

  28. The analyzer follows a structured analysis pipeline:

    1. Receives the Luau source code
    1. Splits the source code into individual lines
    1. Ignores comment-only lines
    1. Runs all registered rules against the source
    1. Provides the appropriate Context to each rule
    1. Stores every Finding with:
    • Line number
    • Warning message
    • Category
    • The relevant source code
    1. If a Rule throws an Exception, the entire Analyzer does not stop. The problematic rule is safely skipped and analysis continues with the remaining rules.
  29. As a result, every detected issue can be reported with:

  30. Line Number + Message + Category + Code


  31. :label: Warning Categories

  32. All Findings are organized into three primary categories:

    • :yellow_circle: Style / Performance / Best Practice
    • :orange_circle: Deprecated API
    • :red_circle: Security / Obfuscation
4 Likes

Model:MoveTo(), Humanoid.PlatformStand, ParticleEmitter.Rate, Workspace.CurrentCamera, SoundService:PlayLocalSound(), StarterGui:SetCore(), Humanoid:Move(), Decal.Texture, StarterPlayerScripts, MarketplaceService:PromptPurchase() and HttpService:JSONEncode() are not deprecated.
LocalizationService:GetCountryRegionForPlayer(), SoundService:RegisterStreamTrack(), PlayerGui:ClearAllChildren() (that’s an Instance method), Backpack:Equip(), Terrain:ClearCells(), GetPlayerByName(), TextBox.TextChanged and Enum.Channels simply do not exist.
GuiService:SetMenuIsOpen() is RobloxScriptSecurity.
Holy AI hallucination

2 Likes

Of course, I gave nearly a few thousand lines of code to the AI ​​to analyze, so there may be errors because as far as I know, the analyzer has no problems.

Where is the source code? Also this gets flagged on VirusTotal


Maybe the reason is that there are things like obfuscations written in the codes and the antivirus thinks these are the program codes that have been obfuscated.

It’s highly possible. But you need to upload the source code on github (or here), not just the exe build; otherwise people will think it’s malicious

1 Like

Yes, but I don’t like people cutting up my files and putting them in their own names. There are many who are masters of copying.

You can cry about the lack of open source for copying projects, that’s your problem.
And if the name of this masterpiece is illusion, I’m proud of it, and you can cry about it too, because now everyone else is proud of it too.