How to check a Roblox model for backdoors

A backdoor is a script hidden in a model that lets someone else run code in your game. Once your game is live they can give themselves admin, show their own purchase prompts, kick players or wreck the place. Most load their code from outside the file, so the model looks harmless and the code can change at any time.

They're common in free models. A model's scripts run inside Roblox, so the danger is to your game and its players, not to your computer.

• require( with a number, like require(1234567890): it loads a module from the Roblox library by its id, so whoever made that module decides what runs in your game. require(script.Parent.Settings) is normal: it loads a module inside the model.
• loadstring( or HttpGet: runs text as code, often fetched from a website.
• getfenv or setfenv: a common way to hide what a script does.
• string.char( with a long list of numbers, or strings of number codes: text spelled out as numbers so you can't read it.
• Code pushed far to the right of a line, past where you'd scroll.
• discord.com/api/webhooks: sends data from your game to someone's Discord.
• .ROBLOSECURITY: reaches for a Roblox login cookie. Never fine.

1. 1

   Use an empty place

   Insert the model into a new Baseplate, not your game, and don't press Play until you've checked it.

2. 2

   Search every script

   Open Find All / Replace All (Ctrl+Shift+F on Windows, ⌘⇧F on Mac) and search for require, loadstring, getfenv and webhooks, one at a time. It looks through every script in the place.

3. 3

   Read each result

   Double-click a result to jump to its line. A require of something inside the model is fine; a require of a number is the classic backdoor.

4. 4

   Don't trust the names

   Backdoors hide in scripts with boring names ("Weld", "Fix", "AntiLag") and deep inside parts and meshes. The search finds them wherever they are.

5. 5

   Remove what you don't trust

   Delete the script, or the whole model, and search again. Then put it in your game.

Forja reads the scripts in the Roblox files sellers upload (.rbxl, .rbxm, and the ones inside a .zip) and looks for the signs above. A listing with any of them stays off the marketplace until a Forja admin has looked at it. A listing shows Scripts checked when Forja read every script in it and found nothing, or an admin looked.

It's a check, not a promise: look for yourself too, above all with models you got anywhere else.