Free tool
Roblox RemoteEvent security scanner
Paste a server script. This finds every client-to-server remote handler in it and tells you which of the seven server-authority guards are missing. No sign-up, no upload, no account.
Your code stays in your browser. This page loads one JavaScript file and declares connect-src 'none', which blocks it from making any network request whatsoever. Turn off your internet and it still works — that is the easiest way to prove it.
What it can and cannot tell you
This is a text-level heuristic, not a parser and not an audit. It locates OnServerEvent and OnServerInvoke handlers and asks whether the obvious guards appear inside each one.
- It reliably finds the classic mistake: a handler that accepts a price, an amount or a damage number from the client and acts on it.
- It will report a false alarm when your validation lives in a helper function called from the handler — the guard is real, the scanner just cannot see into it.
- It cannot prove anything is safe. A typeof check that tests the wrong argument still reads as present. Passing every item means the obvious guards exist, not that the boundary is correct.
For what each of the seven checks actually requires — and a purchase handler written the safer way — read the RemoteEvent security checklist.
Why remotes are the exploit surface
A client request is never proof of anything. It is not proof that the player owns the item, can afford it, is standing close enough, or waited out a cooldown. An exploiter can fire any remote, with any arguments, as fast as they like. Every value that crosses the boundary is untrusted input, and the server has to re-derive the truth rather than believe what it was told.
Find them across the whole project, not one file
Baseplate's Remote Contract Compiler scans your Luau locally and generates validators plus Studio fuzz tests, and Exploit Guard explains each attack in plain language and writes the hardening. Both are in the free plan.
Download Baseplate free