Sandboxed instances with Consequences Capability Disabled can kick players with player.Parent = nil

[Frostilism]

With the consequences API, i expect sandboxed scripts with the Consequences capability disabled to not be able to disconnect players in any capacity.

Sandboxed scripts with the Consequences capability disabled (i’ill call them consequenceless scripts for convenience) arent able to use :kick() or :banasync(), but consequenceless scripts can still get around this by setting the player’s parent to nil, which defeats the whole purpose of declining this ability for sandboxed scripts.

To prevent this, you have to sacrifice and disable other engine API’s to prevent player’s from being read and written.

Placefile to replicate (!!! SET THE PLAYERNAME IN THE SCRIPT IN SERVERSCRIPTSERVICE TO YOURS BEFORE EXECUTING!!)
(join and playtest and look at the console)
Place1.rbxl (60.2 KB)

Expected behavior

I expect nil’ing the player object to not execute if the script does not have the valid capabilities to kick and ban.

[Tavikron (Octav)]

Yes, this is known:

Bypass "Consequences" capability roblox sandbox

I don’t know if this is intentional so im reporting it anyways If the sandboxed script has access to Players capability but doesn’t have Consequences capability you can still workaround it by just destroying the Player instance or just calling ClearAllChildren on Players service same thing works if you just do Player:ResetPropertyToDefault(“Parent”) and the player will be removed from the game regardless of not having Consequences capability however the behavior changes if you disable Players…

[Android7User]

the fact a script without consequences capability can just call ClearAllChildren on Players service and kick everyone is a joke

this is proof that sandboxing cannot stop everything and you need to review scripts before allowing people to run them in your game because it might damage your game’s CCU a lot

edit: my post covers all the methods i could find and its funny that they didn’t bother blocking any of them just Kick and BanAsync is blocked and thats just bare minimum