Roblox RemoteEvent Security: Server-Side Rules
Roblox RemoteEvents provide asynchronous, one-way communication across the client-server boundary without waiting for a response. When a client calls FireServer(), the first parameter received by the server's OnServerEvent handler is always the Player object for the calling client.
Validate on the server
Roblox's security guidance says every piece of data sent by a client must be validated by the server before it is used. Depending on the action, validation should cover context and permissions, type and structure, and whether values are valid and logical.
Both infinity and NaN are valid number values that require explicit rejection. In particular, NaN fails standard comparisons and can therefore bypass range checks that do not test for it directly.
Enforce server-side rate limits
Roblox recommends rate-limiting server logic that clients can trigger and warns developers not to rely solely on client-side limits. A token-bucket limiter permits bounded bursts while restricting sustained request frequency through a steady refill rate.
Keep remotes narrow
Roblox advises limiting the scope and impact of RemoteEvents and avoiding remotes that let clients specify arbitrary paths or Instance references for the server to delete or modify. When relaying client-triggered effects to other clients, the server should validate the request and enforce per-player rate limits instead of acting as an unchecked relay.
Respond proportionally
Roblox describes heuristics as checks that flag technically possible but highly improbable behavior. Its guidance recommends preventing harm first and favoring proportional, reversible consequences because false positives can occur.