Come usare
- Copia il comando e controlla il pacchetto prima di installarlo nel tuo ambiente agente.
- Controlla strumenti, credenziali e ambienti richiesti nel documento originale.
- Descrivi input e risultato desiderato; confronta l’output con le fonti.
npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-securityPrima di iniziare
- L’installazione non include abbonamenti, quote API o accesso ai file.
- Stelle e installazioni indicano attività, non un test indipendente di qualità o sicurezza.
Contenuto dal repository con titoli, esempi, codice, tabelle, link e immagini preservati.
Roblox Security
When to Load
Load for authority, remote abuse, economy, saves, bans, or sandboxing audits. Remote validation/rate limits: roblox-networking.
Quick Reference
Core: Client is always compromised. The server remains the source of truth, but the implementation depends on the authority model.
Authority Models
- Classic replication: validate client requests against server state. Never trust client damage, currency, inventory, permissions, or positions.
- Server Authority:
Workspace.AuthorityMode = Server: the server owns core simulation while clients predict and recover from misprediction. UseBindToSimulation()(needsUseFixedSimulation), not blanketHeartbeatcorrection. Cheap for stock characters, rewrite-scale for authored simulation (full.md). - Both: validate attacks, purchases, teleports, permissions, and custom remotes at the server boundary.
Audit Checklist
CRITICAL: Server-authoritative state · Documented authority model · Validate all arg types · Rate limit remotes · Session-lock DataStore · No client currency mutations · ProcessReceipt verification · No secrets in client code
HIGH: Validate custom movement and action transitions · BindToClose protection · Atomic trading · Never trust client values · Use InputActions for simulation input in Server Authority projects · Validate ProximityPrompt/ClickDetector/DragDetector like remotes
MEDIUM: Server cooldowns · server-computed leaderboards · anti-AFK reward checks · TextService filtering · Script sandboxing for third-party code
Enforcement
Enforcement is a product decision with appeal implications. Players:BanAsync/UnbanAsync are server-only and need Players.BanningEnabled; pcall them. Duration, reason limits and device blocks: full.md.
Anti-Patterns
Don't obfuscate client code, use _G for security, kick without logging, over-validate movement, or rely on client anti-cheat.
See references/full.md for detailed examples.
