测试与安全

roblox-security

Name: roblox-security
Author: tabooharmony

tabooharmony/ro…ox-brain

Use when auditing or hardening Roblox code against exploits: authority, remotes, economy, purchases, and DataStore flows.

2185 次安装
138 星标
收录于 2026.05.28

安装命令

$ npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-security

SKILL.md

Roblox Security

When to Load

Load for authority, remote abuse, economy, saves, bans, or sandboxing audits. Remote validation/rate limits: roblox-networking.

Quick Reference

Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.

Authority Models

Classic replication: validate client requests against server state. Never trust client damage, currency, inventory, permissions, or positions.
Server Authority: Workspace.AuthorityMode = Server: the server owns core simulation while clients predict and recover from misprediction. Use BindToSimulation() (needs UseFixedSimulation), not blanket Heartbeat correction. Cheap for stock characters, rewrite-scale for authored simulation (full.md).
Both: validate attacks, purchases, teleports, permissions, and custom remotes at the server boundary.

Audit Checklist

CRITICAL: Server-authoritative state · Documented authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client code