Security in Roblox Experiences

[Tanks_altNum1]

I’m new to security in Roblox games, and have many questions, if anyone could answer these questions please do.

1. how secure are server scripts?
2. What is the limit to what exploiters can do?
3. What can exploiters see in terms of scripts etc?
4. How simple is exploiting if you have the right tools?

[hellventz]

Only thing i can suggest is don’t have scripts in workspace and for exploiters they can kinda use saveinstance still, but its way different and it doesn’t save scripts.

but yes they can steal your assets still just not scripts, you can maybe add a anti-cheat, but who knows if that will do any good. And never add free models! Here more info about security.

How you should secure your game - A beginner guide for secure networking and developing anticheats

I’ve now open sourced an implementation of one of my anticheats for use in my game Hexolus! You can find more info and the repo links here: Hexolus' Server-sided Anticheat This is a super long thread so read it at your own pace. How you should secure your game You may have seen the “never trust the client” phrase tossed around if you’ve read or created scripting support threads about remotes or game security. I’m going to explain this phrase and give some useful information a…

Guide to maximum game security

This is a guide to prevent most stuff in your game from being exploited, though obviously exploiters can’t be fully prevented, this is a guide to make things in your game much harder (or even impossible!) to exploit.

Free models and plugins

Number 1 - Free Models and plugins This one might be an obvious one but when you’re inserting free models, be careful and ensure they don’t have any malicious scripts. For plugins, ensure the plugin is from a trusted developer/plugin maker as that’s your on…

[Szerpllx (tofu)]

1. No exploiter can access server sided scripts and manipulate them unless there’s some sort of loophole or backdoor.

2. I mean for exploiting, there really is no limit. Depending on how venerable and how secure your game is exploiters can quite literally do nothing or ruin the entire game in a second.

3. I believe exploiters can use Dex which allows them to look but not edit in Workspace, SeverScriptService, StarterPlayerScripts, StarterGui, Replicated Storage, & lighting. I believe they cannot access ServerStorage or Tools. However, any edit they make is only client sided.

4. I mean I know that roblox is cracking down on exploiters with multiple anti-exploits in each update however I believe mobile exploiting is still booming. I mean it depends on what you mean by “simple” but any exploiter can just launch InfiniteYield and fly around your map unless you have an Anti-Cheat set in place.

All in all, exploiters scripts are usually only to manipulate certain things and not ruin your entire game such as boosting their coins or teleportation. If an exploiter has the ability to spawn a Demolition Truck, then that means there’s a backdoor in your game somewhere. You shouldn’t worry too much!

[Tanks_altNum1]

@Szerpllx

that roblox is cracking down on exploiters with multiple anti-exploits in each update however I believe mobile exploiting is still booming. I mean it depends on what you mean by “simple” but any explo

thank you, this was exactly what i was looking for, just one question

@Szerpllx

SeverScriptService, Replicated Storage, StarterGui

if they can access these can they see inside of things such as server scripts and read the code? or simply see what the name of the script is, essentially what we can see in explorer?

[qwertyexpert]

@Tanks_altNum1

if they can access these can they see inside of things such as server scripts and read the code? or simply see what the name of the script is, essentially what we can see in explorer?

Exploiters can only see the name and instance properties of server scripts, they cannot see the source code or bytecode (so decompilers will not work on them).

However, they can see the bytecode of ModuleScripts, but only as long as they are not in ServerStorage or ServerScriptService, whose contents can’t be seen by clients.

@Szerpllx is wrong about a couple things, Dex cannot see anything inside of ServerStorage or ServerScriptService. It can see everywhere else, and it can also make edits, however the edits won’t replicate to the server so they can’t change the game for others. (One exception: they can sometimes delete any instance under their character, even things like scripts, unless Workspace.RejectCharacterDeletions is set to Enabled, which should eventually become the default.)

Generally a client will be able to decompile the bytecode of any LocalScript, ModuleScript, or RunContext Client script that they can see. “See” means that it has been replicated to them at all (parenting something to nil can’t hide it from exploiters). As long as something never leaves ServerStorage or ServerScriptService, it hasn’t been replicated to any clients.

Bytecode is basically a compiled script, it doesn’t have local variable names but a decompiler can sometimes turn it back into some sort of code that works the same way, although it won’t necessarily always be the exact same as the code that you originally wrote.

[Szerpllx (tofu)]

Oops, sorry! Yeah, your right they cannot access ServerStorage or ServerScriptService. However, like I was saying, any edit on scripts or parts are strictly client sided and should not affect other players(?).

[qwertyexpert]

(ugh, wrong reply, trying again)

@Szerpllx

However, like I was saying, any edit on scripts or parts are strictly client sided and should not affect other players(?).

don’t worry, this was addressed:

@qwertyexpert

however the edits won’t replicate to the server so they can’t change the game for others. (One exception: they can sometimes delete any instance under their character, even things like scripts, unless Workspace.RejectCharacterDeletions is set to Enabled, which should eventually become the default.)