Rule reference

The game prompts developer product purchases but no enabled server script assigns MarketplaceService.ProcessReceipt.

Only one ProcessReceipt callback can be active; later assignments replace earlier ones.

ProcessReceipt only works on the server. A client assignment never runs.

A ProcessReceipt handler that never returns PurchaseGranted leaves every purchase unfinished.

The handler never returns NotProcessedYet, so failures are reported to Roblox as success.

Roblox can deliver the same receipt more than once. Handlers should record PurchaseId.

Perks granted from client-side ownership checks can be unlocked by exploiters.

require(assetId) downloads code that is not in your place and can change at any time.

loadstring runs arbitrary text as code and is a common backdoor and exploit vector.

Secrets in source travel with every copy of the place file.

Remote handlers must not write client-supplied amounts into player state.

Obfuscated code cannot be reviewed and is a strong indicator of a backdoor.

getfenv and setfenv are rarely needed and are frequently used to hide malicious code.

A client can fire this remote as often as it likes, and each call makes a DataStore request.

InvokeClient yields until the client answers, and the client controls the answer.

DataStore calls are network requests that can fail and throw.

Games that save to DataStores should save remaining players in game:BindToClose.

SetAsync overwrites whatever is stored. UpdateAsync lets the save check the stored value first.

Loads on join and saves on leave with no lock, so two servers can hold the same player at once.

`while true do` without a wait freezes the script, and on the client the whole game.

DataStore requests inside Heartbeat, Stepped or Touched handlers hit the request limit.

Connecting to a global signal each time a player or character spawns leaks a connection every time.

Entries keyed by player are added but never set to nil when the player leaves.

Firing a RemoteEvent from Heartbeat or a tight loop sends a packet per frame per player.

Changes made by LocalScripts do not replicate to the server.

The legacy scheduling globals are throttled; the task library replaces them.