Free tool
Roblox RemoteEvent security scanner
Who decides the price of an item in your Roblox shop? Compare two versions of the same purchase, then check a server handler from your own game.
Your code stays in your browser. No account or upload. You can run the scanner offline after the page loads.
Try the shop example
What it can and cannot tell you
The scanner looks for text patterns in common inline OnServerEvent and OnServerInvoke handlers. Named callbacks, wrappers and complex signatures need separate review.
- Review value-shaped arguments. Names like price and damage are clues to check which side decides the value.
- Follow helper calls. The scanner may miss a guard inside a separate function.
- Verify behavior. A typeof check can still validate the wrong argument. Try invalid requests and a valid purchase in a private test.
For what each of the seven checks actually requires — and a purchase handler written the safer way — read the RemoteEvent security checklist.
Why remotes are the exploit surface
A client request is never proof of anything. It is not proof that the player owns the item, can afford it, is standing close enough, or waited out a cooldown. An exploiter can fire any remote, with any arguments, as fast as they like. Every value that crosses the boundary is untrusted input, and the server has to re-derive the truth rather than believe what it was told.
Find your first release risk in Baseplate
Open Guide, choose Find what to improve, add your project and run the free local scan. Start with one finding you can reproduce in Studio. The local scan needs no AI account or Open Cloud.
Download Baseplate free