An exploit is code that the player injects into their client in order to allow them to perform actions that would normally not be possible or allowed by the game and exploit it. That explanation of what an exploit is may have been obvious to many, however, what many don’t know is what exactly an exploit is able to access. They do, however, have full access to all client-side code you have for your game, as well as can see anything that your code is doing, one example being what remotes you are firing and what arguments you are providing to them.Įxploits are furthermore, capable of modifying any information that the client is sending through a remote to the server, which effectively rules out any chances of trying to create an anti-exploit where the server asks the client if it is cheating or not.įor further, more-detailed information on what exploits are, you can check out this post made by Autterfly: Exploits are only capable of accessing anything that their client can see, meaning they do not have access to the source code of any server-side scripts. This post is a general information source on common exploiting terminology, tools, and methods. The formatting is in sections for each specific topic, and is in no specific order. If you’re not aware of exploiting by this point, you’ve probably been living under a rock that the pioneers used to ride for miles. While Roblox is seen as open grounds for free reign of exploits, this isn’t the case, and I attempt to tackle this wrong assumption in this post. There are also many misconceptions as to what exactly an anti-cheat should be capable of doing, so in the simplest terms. Yes, an anti-exploit should be checking for if a player is cheating or not and appropriately punishing them for doing so, no, an anti-cheat should not be able to immediately kick or ban a player if it detects they are exploiting.

You don’t want to have players complaining that they were incorrectly banned by your anti-cheat due to a false positive! Why is immediately kicking or banning a player it thinks is exploiting an immediate no? Because your anti-cheat will never be flawless, it is bound to make mistakes and give out false positives, which will be gone over later in this guide. Your anti-cheat should not be capable of completely ruining a player’s experience at all, it should only be slightly inconveniencing them in the event they do accidentally trigger one of your anti-exploits checks. Now, naturally your anti-cheat will run into false positives due to circumstances outside of your control that cannot be avoided or fixed. Examples of this could be due to something like a player with a bad ping (lagging) seemingly going faster than should be allowed or this lag causing them to appear to be teleporting around to the server.

Elysian exploit showcase