Roblox

---

name: Roblox description: Avoid common Roblox mistakes — server/client security, DataStore pitfalls, memory leaks, and replication gotchas. metadata: {"clawdbot":{"emoji":"🎲","os":["linux","darwin","win32"]}}

---

Server vs Client

Server scripts in ServerScriptService — never trust client data

LocalScripts in StarterPlayerScripts or StarterGui — client-only

RemoteEvent for fire-and-forget — RemoteFunction when server needs to return value

ALWAYS validate on server — client can send anything, exploiters will

Security

Never trust client input — validate everything server-side

Server-side sanity checks — is player allowed? Is value reasonable?

FilteringEnabled is always on — but doesn't protect your RemoteEvents

Don't expose admin commands via RemoteEvents — check permissions server-side

DataStore

:GetAsync() and :SetAsync() can fail — wrap in pcall, retry with backoff

Rate limits: 60 + numPlayers × 10 requests/minute — queue writes, batch when possible

:UpdateAsync() for read-modify-write — prevents race conditions

Session locking — prevent data loss on rejoin, use :UpdateAsync() with check

Test with Studio API access enabled — Settings → Security → API Services

Memory Leaks

Connections not disconnected — store and :Disconnect() when done

:Destroy() instances when removed — sets Parent to nil and disconnects events

Player leaving without cleanup — Players.PlayerRemoving to clean up

Tables holding references — nil out references you don't need

Character Handling

Character may not exist at PlayerAdded — use player.CharacterAdded:Wait() or event

Character respawns = new character — reconnect events on CharacterAdded

Humanoid.Died fires on death — for death handling logic

LoadCharacter() to force respawn — but prefer natural respawn usually

Replication

ServerStorage: server-only — clients can't see

ReplicatedStorage: both see — shared modules and assets

ReplicatedFirst: loads first on client — loading screens

Workspace replicates to clients — but server is authority

Services Pattern

game:GetService("ServiceName") — don't index directly, fails in different contexts

Cache service references — local Players = game:GetService("Players")

Common: Players, ReplicatedStorage, ServerStorage, RunService, DataStoreService

RunService

Heartbeat after physics — most gameplay logic

RenderStepped client only, before render — camera, visual updates

Stepped before physics — physics manipulation

Avoid heavy computation every frame — spread over multiple frames

Common Mistakes

wait() deprecated — use task.wait() for reliable timing

spawn() deprecated — use task.spawn() or task.defer()

Module require returns cached — same table across requires, changes shared

:Clone() doesn't fire events — manually fire if needed

Part collisions with CanCollide false — still fire Touched, use CanTouch