Hello,
I’ve seen a lot of posts, mainly on Reddit, where new Roblox developers insert Roblox toolbox assets “blindly” and then receive a fake error message from said toolbox assets asking them to either:
- copy and paste code into their command bar
- manually go ahead and enable
HttpServicein the game’s “Security” settings.
This is why I’m requesting a feature in Roblox Studio alongside the “Security” tab, which won’t fix those models but at least the remote data part.
What is this?
Now, developers will have to add their URL with an allow-list (or whitelist if you prefer) in order for requests to go through. This will prevent requests to remote services such as a Discord webhook with either an error or a warning on the surrounding HttpService request.
Want to see the Figma design? Click here!
Why?
This will make it harder for free model scripts to make HTTP requests to external services and send game data over to attackers.
The problem
That does mean that a lot of legitimate games and models will have to migrate over, which will probably be a pain in the butt. But this can be enabled by default for new games and kept disabled for currently existing games.
Conclusion
I hope someone at Roblox could implement this. This would help for a lot of security and prevent requests. If you have any questions, feel free to ask here and/or edit the Figma design.