roblox-securitylisted

# Roblox Security Audit ## Purpose Every Roblox client runs on hardware the attacker controls. Exploit executors inject Luau into the client context, so an attacker can read every LocalScript and every ModuleScript in `ReplicatedStorage`, call any `RemoteEvent` or `RemoteFunction` with any arguments at any rate, and change any value the client owns. Nothing the client sends is evidence of anything. **The governing rule: the client is a rendering and input surface, never a source of truth.** It may say "the player pressed the buy button on slot 3". It may never say "the player bought item 3 for 0 coins". This skill is the procedure for auditing a codebase against that rule and reporting what it finds. ## When to use - Reviewing or writing any handler bound to `OnServerEvent` or `OnServerInvoke`. - Anything that grants currency, items, XP, badges or products. - Anything that reads or writes player data through `DataStoreService`. - A report of duplicated items, impossible currency balances, rolled-back inventories or free purchases. - Before shipping an update, as a standing pre-release pass. - Any request phrased as "add an anti-cheat" — the answer is almost always server authority, not detection. ## When NOT to use - Designing the remote surface in the first place — use `roblox-client-server-architecture`, then audit it with this skill. - DataStore mechanics, retries and schema migration for their own sake — use `roblox-datastore-persistence`. - Writing the pur