Trust Boundaries & Threat Surface

# Architectural Boundaries

Roblox experiences run across two distinct environments:

[ UNTRUSTED ZONE: The Client Device ]
- Memory: Fully readable and writable by executors (Synapse, Wave, Solara, Dex Explorer).
- Metatables: Hookable (hookmetamethod, __namecall).
- Network: Can fire any RemoteEvent/RemoteFunction with arbitrary arguments.
- File Access: Can decompile any script located in ReplicatedStorage, StarterPlayer, or PlayerGui.

═════════════════════════ NETWORK BOUNDARY ═════════════════════════

[ TRUSTED ZONE: The Roblox Server ]
- Memory: Completely inaccessible to players.
- Execution: Private server Lua environment (ServerScriptService, ServerStorage).
- File Access: Clients cannot view or decompile server code.
- Authority: The single source of truth for physics, economy, health, and player data.

---

# 3 Core Rules of RAC Security

# Rule 1: Never Trust Client Calculations

Never accept a client-reported calculation (e.g. "I dealt 85 damage", "I collected 50 coins", "I reached stage 10"). The client may only report its intent (e.g. "I swung my sword"). The server calculates the outcome based on game state.

# Rule 2: Keep Sensitive Code in ServerScriptService

Never put moderation logic, ban lists, or webhook URLs inside ReplicatedStorage. In RAC, all enforcement logic resides in ServerScriptService/RAC/.

# Rule 3: Rate Limit Every Entrypoint

Every RemoteEvent and RemoteFunction exposed to clients is an open public API. Without rate-limiting, an attacker can crash the server by firing a remote $10,000$ times in a single frame.

---

# Next Steps

• Review the Threat Model & Exploit Mitigations.
• Read Security Best Practices.