Security
Your game is your business. We treat it that way.
This page describes what shipLua does today and what is still being built. If something here is marked as in development, it is not yet available. Pending Roblox approval means the integration is built and encrypted; Roblox has not finished reviewing the shipLua OAuth app yet.
Accounts
- Password storage
- Argon2id with memory-hard parameters. Plain passwords are never stored or logged.
- ● Live
- Brute-force protection
- Per-account lockout after repeated failures and per-IP rate limits on sign-in.
- ● Live
- Sessions
- Random 256-bit tokens in HttpOnly, SameSite cookies. Only a hash is stored, so a database leak cannot be replayed.
- ● Live
- Cross-site request forgery
- Every change needs an allow-listed origin, a JSON body and a session-bound token.
- ● Live
- Two-factor authentication
- Authenticator-app (TOTP) codes with one-time recovery codes. The secret is envelope-encrypted at rest with a key held outside the database. Required for workspace owners and admins.
- ● Live
Workspaces
- Isolation
- Every query is scoped to your workspace in code, and PostgreSQL row-level security enforces it again in the database.
- ● Live
- Roles
- Owner, admin, developer, analyst and viewer. Permissions are checked on the server for every request; the interface never decides.
- ● Live
- Activity log
- Sign-ins, membership changes, audits and triage decisions are written to a log the application cannot edit or delete.
- ● Live
Your game
- Uploads
- Analyzed in memory and discarded. We keep the file name, a SHA-256 hash, counts and findings.
- ● Live
- Excerpts
- Findings include a few lines around each issue. Recognised credentials such as webhook URLs and API tokens are masked.
- ● Live
- Untrusted input
- Place files are parsed with entity expansion disabled and strict size and depth limits. Scripts are read, never executed.
- ● Live
- Roblox access
- Official OAuth 2.0 with PKCE and scoped Open Cloud API keys, read-only scopes only. Tokens are envelope-encrypted and bound to their workspace, and deleted on disconnect. Uses the same key service as two-factor authentication. Encryption is on; the shipLua OAuth app is still in Roblox’s private beta (10 unique users) until Roblox finishes review.
- ○ Pending Roblox approval
Roblox credentials
shipLua will never ask for your Roblox password or your .ROBLOSECURITY cookie, and it does not use endpoints that require them. A cookie gives full control of an account, including Robux and group funds. Any tool that asks for one should be treated as compromised.
Changes to live games
Today shipLua is read-only: it audits exports you upload. Future features that can change a game will require explicit approval from a person in your workspace for every change, and automated agents will never be able to approve their own work or raise their own permissions. Prices will never be changed automatically.
Reporting a vulnerability
A dedicated security contact will be published before general availability. Until then, please report issues through the address you received with your early-access invitation.
More detail on what we store: Data handling.