Where to start with Exploit Protection?

[mocrews1 (mocrews)]

I am in the process of organization and testing before the release of my game. I am fairly certain that now is the best time for me to look into anti-exploiting. Could I get any helpful feedback regarding where I should begin, what I should know and what to do in order to make my game as protected as possible. |

–So far I have to the best of my ability maintained server-sided checks and have taken full advantage of remote events in almost everything. But I also understand that there is more that can be done, just the matter of what is best/efficient and what I can do.

–Thank you lookin’ forward to some help.

[byc14 (byc)]

There are a lot of resources and threads available addressing this question. You can find them using the search feature.

Exploiting Explained

Exploiting Explained: Second Revision This post is a general information source on common exploiting terminology, tools, and methods. The formatting is in sections for each specific topic, and is in no specific order. If you’re not aware of exploiting by this point, you’ve probably been living under a rock that the pioneers used to ride for miles. While Roblox is seen as open grounds for free reign of exploits, this isn’t the case, and I attempt to tackle this wrong assumption in this post. Th…

Tips on game security?

Don’t worry about attempting to hide or obfuscate your client-sided logic. It is fundamentally impossible to completely hide it because it exists on the clients machine, which they have full control of. Obfuscating or hiding your logic won’t provide any security benefits, and is pretty redundant because it won’t prevent a dedicated malicious actor. Focus on implementing a correct client/server modal. Validate all information from the client and have the server take an authoritative stance. It s…

Outside of implementing a secure client/server modal (authoritative server, sanity checks, type checking, etc) and possibly implementing server-side checks to prevent physics based exploits, not much. I do want to take the time to stress the importance of static analysis when it comes to using third party plugins and models though, as these may (and often do) contain malicious code then which gets executed in your game/dev environment.

[MetaProx]

Actually there’s a really great thread that covers most of what you’re looking for!

How you should secure your game - A beginner guide for secure networking and developing anticheats

I’ve now open sourced an implementation of one of my anticheats for use in my game Hexolus! You can find more info and the repo links here: Hexolus' Server-sided Anticheat This is a super long thread so read it at your own pace. How you should secure your game You may have seen the “never trust the client” phrase tossed around if you’ve read or created scripting support threads about remotes or game security. I’m going to explain this phrase and give some useful information ab…

[mocrews1 (mocrews)]

Thank you, both of those threads were something I was NOT aware of Alot of good information present there though. Much appreciated.

[mocrews1 (mocrews)]

Thank you, this was helpful as well.