scenario-roblox-networking

Roblox Networking and Security

Target: Roblox Studio (October 2026 build) on macOS, driven through the scenario-roblox-expert toolkit.

Expert level here means every client-triggerable action is attacker input: the server owns state, checks each call in a fixed order, and proves it by firing hostile arguments from a playtest client. Detection supplements validation, and visible consequences come late, from varied signals.

If a sibling skill named here is missing from your available skills, ask the user to install it (npx skills add scenario-labs/skills --skill <name>); unattended, proceed from tool schemas and flag the gap.

REQUIRED BACKGROUND: scenario-roblox-expert (channels, review loop, toolkit, current-Roblox traps).

Stance (the expert delta)

1. Remotes carry intent, never results. The client names an item, and the server prices it. A

weapon reports origin and hit point, never the victim or the damage (Creator Docs, client-server boundary; GnomeCode).

1. Check in a fixed order: rate, then arguments, then context. The docs list context, type,

value and rate; running the rate limit first is cheapest [added]. NaN passes typeof(v) == "number" and fails every comparison, so use math.isfinite (Creator Docs; Suphi Kaner). Live, NaN and infinity payloads through a handler that only range-checked set an IntValue balance to -9223372036854775808.

1. An Instance argument is a claim. Check typeof and IsDescendantOf(expectedFolder): a table

can mimic an Instance, and a client can replay a destroyed pickup it still references (Creator Docs; Suphi Kaner).

1. Every client-triggerable surface is a remote. ProximityPrompt checks distance on Triggered

only and ignores Enabled. ClickDetector has no server checks. Touched reports the client's physics (Creator Docs; Suphi Kaner).

1. **Movement: Server Authority for new competitive games, a server MoveGuard for existing casual

places.** The deciding condition is genre plus whether you can adopt fixed simulation, InputActions and streaming (Creator Docs; Jason Knight, Roblox). Server Authority does not stop ESP, aimbots or camera abuse (ev1).

1. Validate hits against what the attacker saw. Roblox has no built-in lag compensation (ev1).

Rewind server-recorded positions over [now - min(ping + 0.1, 0.4), now] [added], or use a cone of about 10 degrees (ev1). Obstruction uses static geometry only (Creator Docs).

1. Consequences climb a ladder and arrive late. Keep a decaying suspicion score, require two

distinct reasons before enforcement, and delay visible action randomly by 20 to 90 s [added numbers]. Honeypot remotes and direction honeypots are high-confidence signals (Creator Docs, server-side detection). For movement, rubber-band instead of kicking, because lag causes false positives (GnomeCode).

1. UnreliableRemoteEvent only for frequent cosmetic data under 1,000 bytes. The cap is 1,000

bytes (Creator Docs); the 900 figure in a 2025 Roblox Learn video is outdated, and live a 980-byte random buffer arrived while 1,000 was dropped. Both remote types need identical validation.

Establish first

• Workspace.AuthorityMode: Automatic means client-owned characters (MoveGuard applies); Server

means the engine simulates them. rbx_net.audit_place(place) reads all six settings offline.

• Stakes: competitive or casual, live or prototype. A prototype can defer honeypots and the ladder,

never validation.

• Remote inventory: name, direction, frequency, payload size, and what server value each handler

writes.

• Interactive surface: prompts, ClickDetectors, DragDetectors, Touched pickups, and whether their

parents are unanchored.

• Enforcement policy: kick, Players:BanAsync, or mitigation only; who handles appeals

(Net.reset).

• Defaults when unanswered: every remote through Net.bind, one honeypot, Net.serverOnly on

server-to-client remotes, enforcement as a dry run during tests.

Procedure

Run each stage through the toolkit; full code and test results are in procedures.md. Status: 24 live tests pass in Studio 0.743 (arena rerun and Server Authority place on 2026-10-19). Keep NetKit (Guard, RateLimit, Suspicion, Net, HitCheck, MoveGuard) as ModuleScripts under one server folder. rbx_net.kit_tree(project_dir) gives the Rojo fragment for a test place; in a user's repository, rbx_net.vendor_kit(repo, dest) copies the modules in and returns paths inside it.

1. Audit. Goal: a list of every remote, handler and interactive instance with findings. How:

rbx_net.audit_place(place) offline (Lune), then rbx_net.run(studio, "return NetAudit.run(game, Audit)", kit=["NetAudit"], lead_kit=["Audit"]) in Edit. GATE: zero errors; every warning fixed or justified; live tally equals offline tally.

1. Validate and limit. Goal: no handler runs on bad arguments or at flood rates. How:

Net.bind(remote, {args = {Guard...}, limit = {capacity, perSecond}, handler = fn}) for every client-to-server remote; idempotent handlers on the server clock. GATE: the audit shows no handler-unvalidated, nan-unsafe, trusted-value or no-rate-limit finding.

1. Hits. Goal: claims checked against history. How: a 1 s HitCheck.History per target pushed

every Heartbeat, HitCheck.melee and HitCheck.ranged with ExcludeInstances or IncludeInstances for static walls. GATE: out-of-reach, fake-origin, through-wall and offset shots rejected; valid shots hit.

1. Movement. Goal: speed and teleport hacks neutralized without false positives. How: Server

Authority (Rojo writes the settings, stage P11), or MoveGuard.start with MoveGuard.grace(player, s) before every server teleport; enforce = false only logs, then measures from where the character stands. GATE: honest walk 0 flags; client teleport and local WalkSpeed changes rubber-banded (live: WalkSpeed 80 for 2.5 s netted 12.6 studs on the server). Under Server Authority, live: W held 2 s moved the server character 32.4 studs, a client teleport 0, local WalkSpeed 80 then W 32.0.

1. Ownership and surfaces. Goal: no client-owned part decides an outcome. How:

SetNetworkOwner(nil) on unanchored pickups, NPC roots and prompt parents; Net.prompt re-checks distance, state and rate; a distance check in MouseClick; Net.touch for Touched pickups (toucher, CanTouch, distance, MoveGuard reach, shared limiter). GATE: a client CFrame write moves nothing on the server.

1. Exploit tests from the Client. Goal: proof, not intent. How: in a Playtest,

rbx_net.fuzz(pt, path, gap=...), a same-frame spam, a honeypot fire, then rbx_net.net_log(pt) in the Server data model. Include a deliberately vulnerable remote as a negative control. GATE: balances and health unchanged, ok_<Remote> equals the valid-case count, no server script error, the negative control pays out. A Touched pickup has no remote: use exploit_case with a client teleport onto the part, then a Net.touch part and a bare Touched part side by side (P6).

1. Detection and consequences. Goal: high-confidence signals, delayed action. How:

Net.init({enforce = ..., enforceDelay = {20, 90}}), Net.honeypot, Net.serverOnly. GATE: one honeypot fire reaches enforce with a scheduled delay; a flood alone stays below restrict.

1. Latency. Goal: valid play survives real ping. How: rbx_net.set_latency(studio, 100, 100) in

Edit before Play, last-moment swings at a moving target. GATE: rewind hit rate at least 0.8. Live at 202 ms ping: rewind 13 of 13, no rewind 0 of 13 (three runs). Trigger the swings close to reach plus slack: with 0.2 s of margin left, the no-rewind rate swung from 31 to 92 percent between runs.

1. Bandwidth. Goal: small, on-change traffic. How: rbx_net.payload_probe before choosing

unreliable delivery; pack with buffer; sequence numbers on streams. GATE: payloads measured under the cap; stream accepted count equals sent.

Numbers

Quality gates

Measurable:

• Audit: zero errors; every warning resolved or written down with a reason.
• Fuzz: every hostile case lands in args_<Remote> or rate_<Remote>; balances, health and pickups

unchanged.

• Spam: 1,000 same-frame reward fires grant once; purchases never exceed the bucket.
• Hits, movement, ownership, prompts: verdict counters match the test cases (procedures P4 to P6).
• Console during the fuzz: no ServerScriptService.<script>:<line> error from your handlers.
• Latency: hit rate at 100 ms each way within 0.2 of the baseline.
• Types: zero errors on both Luau solvers, luau-lsp analyze with and without

--flag:LuauSolverV2=true, with a sourcemap built by rojo sourcemap --include-non-scripts (scenario-roblox-tooling gate).

Visual:

• A client capture during play with no flags from rbx_review.image_checks.
• For Server Authority, the visualizer under simulated latency (GUI only,

gui-paths.md).

Score the result with critique.md before calling it done.

Common mistakes

Handoffs

• Receives from scenario-roblox-architecture: the remote list, folder layout and where state lives.
• Receives from scenario-roblox-gameplay: hitbox, projectile and ability rules to validate.
• Delivers to scenario-roblox-data: validated, finite, size-checked values before any save, plus

trade and purchase atomicity questions.

• Delivers to scenario-roblox-monetization: grants only from ProcessReceipt; the purchase-signal

finding.

• Delivers to scenario-roblox-performance: payload sizes, send rates and the Server Authority

simulation budget.

• Asks scenario-roblox-luau for buffer packing and Parallel Luau questions, and

scenario-roblox-tooling for CI wiring of the offline audit.

Current Roblox notes

• Server Authority reached full release on 2026-07-09. AuthorityMode Server sets StreamingEnabled,

Deferred signals, UseFixedSimulation, NextGenerationReplication and PlayerScriptsUseInputActionSystem.

• Scripts cannot read or set those settings from Studio's MCP context ("lacking capability

RobloxScript"); write them in the Rojo project or the Properties panel. Check them by behavior: Deferred signals, input-only movement.

• Inside BindToSimulation, use time(); task.defer leaves the simulation step; effects belong

in RenderStepped, not in the simulation.

• RaycastParams.ExcludeInstances and IncludeInstances replace FilterDescendantsInstances and

FilterType (2026-04-07); Blacklist and Whitelist are gone.

• The Network Simulator is in beta and drives NetworkSettings; the legacy IncomingReplicationLag

still exists but is not the tool.

• Yielding APIs carry the Async suffix (BanAsync, UnbanAsync, GetBanHistoryAsync).

References

• references/expert-notes.md: principles and judgment by expert, with

timestamps and live measurements.

• references/procedures.md: full code for stages P1 to P11 with test ids

and live results; loose-part and detector checks (P6), the Server Authority migration list (P11) and ordering traps.

• references/critique.md: pass and fail rubric for your own output.
• references/gui-paths.md: Studio menus for the same tasks, with scripted

substitutes.

• references/sources.md: every doc and video, with credentials and

timestamps.

• scripts/rbx_net.py: audit, kit tree, fuzz, payload probe, latency and NetLog

helpers.

• scripts/agentkit/networking/: Guard, RateLimit, Suspicion,

Net, HitCheck, MoveGuard, Exploit, NetAudit, lune_net_audit.luau.