RBXGuard - I'm exploring an open-source security scanner for Roblox games. Here's why.

I've been exploring GitHub recently, looking at projects that are gaining traction and trying to understand what developers actually need.

One area that caught my attention is the intersection of AI-assisted development, game development and cybersecurity.

That led me to an idea I've started working on: RbxGuard.

The problem

Roblox makes it relatively easy to build multiplayer games using Luau, RemoteEvents and RemoteFunctions.

But there's an important security problem that is easy to overlook:

Your client is not trustworthy.

Consider a simple currency system:

giveCoins.OnServerEvent:Connect(function(player, amount)
    player.leaderstats.Coins.Value += amount
end)

Looks harmless, right?

The problem is that amount comes from the client. An exploiter could manipulate the value sent to the server and potentially grant themselves an unreasonable amount of in-game currency.

The server should validate the request and independently determine whether the player is eligible for the reward.

This is just one example of a broader category of vulnerabilities involving client-server trust.

And it got me thinking:

What if Roblox developers had an easy-to-use tool that could identify these problems before their games were published?

Introducing RbxGuard

RbxGuard is an open-source project I'm exploring to make security auditing more accessible to Roblox developers.

The idea is simple:

Scan your Luau code. Find potentially exploitable patterns. Understand why they're dangerous. Get actionable recommendations to fix them.

The initial vision includes:

• RemoteEvent auditing: Identify potentially unsafe client-to-server communication.
• RemoteFunction auditing: Detect suspicious handling of client-controlled input.
• Input validation checks: Identify missing or insufficient validation.
• Authorization checks: Find potentially unsafe player permissions and ownership checks.
• Game-state protection: Identify suspicious currency, inventory, health and damage modifications.
• Security reports: Generate readable reports alongside JSON and SARIF output.
• AI coding-agent integration: Allow tools like Codex and Claude Code to understand findings and assist with remediation.

I'm particularly interested in making the scanner deterministic wherever possible, with findings backed by source-code evidence rather than relying entirely on an LLM to decide whether something is vulnerable.

Why AI integration?

Something else I've been following is the growing adoption of AI coding agents.

Developers are increasingly using agents to generate code, build applications and automate development workflows.

Roblox development is also becoming part of this shift.

I think there is an interesting opportunity here:

1. An AI agent generates or modifies a Roblox game.
2. RbxGuard scans the resulting Luau code.
3. It identifies potentially vulnerable code paths.
4. The developer or coding agent reviews the findings.
5. A proposed fix is applied and the scanner runs again to verify the result.

The idea isn't to replace developers or security researchers. It's to make security checks a more natural part of the development workflow.

What I'm planning to build first

I'm deliberately keeping the first version focused.

The initial MVP will concentrate on:

• Luau source parsing.
• RemoteEvent and RemoteFunction analysis.
• Detection of client-controlled values reaching sensitive operations.
• Evidence-backed security findings.
• A simple CLI interface.
• JSON and terminal reports.

I'm planning to use TypeScript and Node.js for the CLI and analysis infrastructure, with an architecture that can support more advanced integrations later.

I'm also exploring how to support Rojo-based projects initially.

RbxGuard is currently in the planning and early development stage. These are proposed capabilities, not features I'm claiming are already implemented.

I'd love feedback from the Roblox community

Before going too far with implementation, I'd like to hear from people who actually develop Roblox games.

A few questions:

1. What are the most common security mistakes you encounter when developing Roblox games?
2. Are there particular RemoteEvent or RemoteFunction vulnerabilities you'd like an automated scanner to detect?
3. Would you prefer a CLI tool, a Roblox Studio plugin, or both?
4. Would integration with Codex, Claude Code or other AI coding agents be useful to your workflow?
5. What existing Roblox security tools do you currently use, and what do you wish they did better?

I'm especially interested in feedback from experienced Roblox developers and people who work with Luau regularly.

A little about the project

Repository: Coming soon

Project: RbxGuard

Focus: Roblox security, Luau static analysis and AI-assisted development.

I'm building this as an open-source project and would love to have other developers contribute ideas, identify edge cases and help shape its direction.

If this sounds interesting, I'd love to hear your thoughts!

Let's make secure Roblox development a little easier.