Suggestion: Add Script.Source Read-Only Access on Server for ModuleScripts

[StormyGab (storm)]

I would like to suggest the addition of a secure, read-only version of Script.Source, accessible only from the server, and only for ModuleScript instances.

---

Why this is needed:

Currently, there is no official way to access the actual source code of a ModuleScript from the server side. In many advanced systems, especially tools like plugin frameworks, custom module managers, or cloud script version checkers, this kind of read-only access could be extremely helpful for:

• Debugging purposes
• Security scanning for malicious or injected code
• Code syncing/version control for development pipelines
• Reading & caching scripts dynamically without executing them

---

Security Considerations:

• This feature should not expose the code of Script (regular server-side scripts) to avoid any exploitation risk.
• It should only be accessible from the server environment, and never from the client.
• The returned Source property should be read-only and not modifiable.
• An optional ReadSource method instead of a direct .Source property could further clarify its purpose.

---

Example Usage:

local module = script.Parent:FindFirstChild("ExampleModule")
if module and module:IsA("ModuleScript") then
    local source = module:GetSource() -- or module.Source (read-only)
    print("Module source:\n" .. source)
end

---

Final Thoughts:

This change would open the door for many advanced backend systems while maintaining security boundaries. Server-side only read-access to the script source is a powerful tool for developers without compromising the security of the game or engine.

Thanks for considering this!

[Mortai_Yt (xM_MORT)]

@StormyGab

Currently, there is no official way to access the actual source code of a ModuleScript from the server side.

I’m confused. There is already a script.Source property for all types of scripts.

@StormyGab

• This feature should not expose the code of Script (regular server-side scripts) to avoid any exploitation risk.

The already-existing “Source” property is not exposed to clients since all regular server-side scripts are server-side only, and not shown to clients.

@StormyGab

and only for ModuleScript instances.

Haven’t you contradicted yourself by talking about how the property should function for regular Script instances, although previously stating it should only be for module scripts?

Am I missing something here? What’s the need for this feature?