Security Best Practices for Roblox

Best Practices

Hardening remotes, secret hygiene, server validation rules, and eliminating false positives.

# 1. Remote Hardening

Never create a generic "SetStat" remote: Never expose a remote where the client sends (statName, value). An exploiter will immediately call SetStat:FireServer("Coins", 999999999).
Always authenticate on the server: Never trust a userId argument sent by the client. The first argument of every OnServerEvent is player, populated authoritatively by the Roblox engine. Always use player.UserId.
Validate every parameter type: Ensure strings are strings, numbers are within valid ranges, and booleans are booleans:
```
if type(quantity) ~= "number" or quantity <= 0 or quantity > 100 then
    return -- Reject invalid input
end
```

Never place Discord Webhooks in client scripts: Anyone can decompile your LocalScripts and steal your webhook URL to spam or delete your channel.
Store secrets on the server: Webhook URLs, private keys, and API tokens should only ever reside in ServerScriptService.

Use RAC Exemptions for Abilities: Whenever your game applies a dash, speed boost, knockback, or launch pad, call RAC:AddExemption(player, reason, duration). This guarantees clean gameplay without triggering false flags.
Avoid extreme gravity manipulation: If your game uses custom gravity controllers (e.g. wall walking), adjust Config.AntiFalseDetection.FreefallAccelerationTolerance to accommodate your custom physics model.