I am experiencing a bug very similar to the post above in my game Kohaú Hibachi Restaurant | Play on Roblox, where users are able to join my game and disconnect all users from the server. I am unsure of the exact method they are using, though they have done it in two of my games with completely different codebases, so it seems unlikely that it is a vulnerability in my codebase with remotes etc. It seems more like a DDOS attack, the users behind it have admitted to doing it using server crash exploits too. We don’t use ReservedServers so these are normal public servers that they’re crashing.
Here are some of the kick messages we observed:
This happens quite often in my game and we have been unable to prevent these users from joining / crashing using the Ban API (including alt detection + device banning). As mentioned in the OP, our remotes are secure + this only happens when specific users deliberately do it, so we think it’s a Roblox issue that they’re taking advantage of.
cc @SuperPat77