Roblox security

Exploiters fully control their client: they can run any Luau, read every replicated script (decompiled), fire any remote with any arguments at any rate, edit any local property (WalkSpeed, prompt Enabled, MaxActivationDistance), and move anything they have network ownership of. Client-side anti-cheat is at best a speed bump. Security comes from server design.

Core rules

1. The server decides. Clients send intent ("I pressed attack aiming here"), never results ("I dealt 50 damage", "give me 100 coins").
2. Validate every argument of every OnServerEvent/OnServerInvoke: type, structure, range, finiteness.
3. Validate context: is the player alive, in range, not on cooldown, owns the item, allowed to act?
4. Rate limit everything a client can trigger (remotes, prompts, touches, clicks).
5. Keep secrets server-side: server code in ServerScriptService/ServerStorage; API keys via HttpService:GetSecret(); never ship unreleased content to production places.
6. Prefer silent mitigation (drop, clamp, correct state) over instant kicks; escalate on repeated signals.

Argument validation toolkit